{"id":"CVE-2026-20290","title":"A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 2 Detection Engine to restart.\r\n\r\nTh…","summary":"A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 2 Detection Engine to restart.\r\n\r\nTh…","severity":"medium","cvss":5.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","cwe":["CWE-805"],"vendor":"Cisco","product":"Cisco Secure Firewall Threat Defense (FTD) Software","affected":["secure_firewall_threat_defense_ftd_software 7.0.0","secure_firewall_threat_defense_ftd_software 7.0.0.1","secure_firewall_threat_defense_ftd_software 7.0.1","secure_firewall_threat_defense_ftd_software 7.0.1.1","secure_firewall_threat_defense_ftd_software 7.0.2","secure_firewall_threat_defense_ftd_software 7.2.0","secure_firewall_threat_defense_ftd_software 7.0.2.1","secure_firewall_threat_defense_ftd_software 7.0.3","secure_firewall_threat_defense_ftd_software 7.2.0.1","secure_firewall_threat_defense_ftd_software 7.0.4","secure_firewall_threat_defense_ftd_software 7.2.1","secure_firewall_threat_defense_ftd_software 7.0.5","secure_firewall_threat_defense_ftd_software 7.3.0","secure_firewall_threat_defense_ftd_software 7.2.2","secure_firewall_threat_defense_ftd_software 7.2.3","secure_firewall_threat_defense_ftd_software 7.3.1","secure_firewall_threat_defense_ftd_software 7.2.4","secure_firewall_threat_defense_ftd_software 7.0.6","secure_firewall_threat_defense_ftd_software 7.2.5","secure_firewall_threat_defense_ftd_software 7.2.4.1","secure_firewall_threat_defense_ftd_software 7.3.1.1","secure_firewall_threat_defense_ftd_software 7.4.0","secure_firewall_threat_defense_ftd_software 7.0.6.1","secure_firewall_threat_defense_ftd_software 7.2.5.1","secure_firewall_threat_defense_ftd_software 7.4.1","secure_firewall_threat_defense_ftd_software 7.2.6","secure_firewall_threat_defense_ftd_software 7.0.6.2","secure_firewall_threat_defense_ftd_software 7.4.1.1","secure_firewall_threat_defense_ftd_software 7.2.7","secure_firewall_threat_defense_ftd_software 7.2.5.2","secure_firewall_threat_defense_ftd_software 7.3.1.2","secure_firewall_threat_defense_ftd_software 7.2.8","secure_firewall_threat_defense_ftd_software 7.6.0","secure_firewall_threat_defense_ftd_software 7.4.2","secure_firewall_threat_defense_ftd_software 7.2.8.1","secure_firewall_threat_defense_ftd_software 7.0.6.3","secure_firewall_threat_defense_ftd_software 7.4.2.1","secure_firewall_threat_defense_ftd_software 7.2.9","secure_firewall_threat_defense_ftd_software 7.0.7","secure_firewall_threat_defense_ftd_software 7.4.2.2","secure_firewall_threat_defense_ftd_software 7.2.10","secure_firewall_threat_defense_ftd_software 7.6.1","secure_firewall_threat_defense_ftd_software 7.4.2.3","secure_firewall_threat_defense_ftd_software 7.0.8","secure_firewall_threat_defense_ftd_software 7.6.2","secure_firewall_threat_defense_ftd_software 7.0.8.1","secure_firewall_threat_defense_ftd_software 7.6.2.1","secure_firewall_threat_defense_ftd_software 7.4.2.4","secure_firewall_threat_defense_ftd_software 7.2.10.2","secure_firewall_threat_defense_ftd_software 7.4.3"],"published":"2026-09-16","updated":"2026-09-18","sourceUpdated":"2026-09-18T13:28:28.567","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20290","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort2-ssldos-Mw7WYX9c","label":"psirt@cisco.com"},{"url":"https://software.cisco.com"}],"tags":["nvd","cve.org","csaf","vendor-advisory","cisco"],"epss":0.0019,"epssPercentile":0.08873,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-17T17:25:32.306457Z"},"ingestedAt":"2026-09-16T16:37:52.173Z","slug":"CVE-2026-20290","body":"## Overview\n\nA vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 2 Detection Engine to restart.\r\n\r\nThis vulnerability is due to incomplete validation of the SSL certificate. An attacker could exploit this vulnerability by sending a crafted SSL connection setup request to be parsed by Snort 2. A successful exploit could allow the attacker to cause the Snort 2 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **cisco-sa-ftd-snort2-ssldos-Mw7WYX9c** · Cisco · affected: Cisco Firepower 2100 Series, Cisco Firepower 1000 Series, Cisco ASA 5500-X Series Firewalls, Cisco 3000 Series Industrial Security Appliances (ISA), Cisco Firepower 9000 Series, Cisco Firepower 4100 Series, … · updated 2026-09-16 · [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort2-ssldos-Mw7WYX9c)","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}