---
id: CVE-2026-20026
title: Multiple Cisco Products Snort 3 DCERPC Vulnerabilities
summary: >-
  Multiple Cisco products are affected by vulnerabilities in the processing of
  Distributed Computing Environment Remote Procedure Call (DCE/RPC) requests
  that could allow an unauthenticated, remote attacker to cause the Snort 3
  Detection Eng…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L'
cvssSource: vendor
vendor: Cisco
product: Cisco Firepower 1000 Series
affected:
  - firepower_2100_series
  - firepower_1000_series
  - asa_5500_x_series_firewalls
  - 3000_series_industrial_security_appliances_isa
  - firepower_9000_series
  - firepower_4100_series
  - secure_firewall_threat_defense_virtual
  - secure_firewall_3100_series
  - secure_firewall_4200_series
  - secure_firewall_1200_series
  - utd_snort_ips_engine_software 17.12.1a
  - utd_snort_ips_engine_software 17.12.2
  - utd_snort_ips_engine_software 17.13.1a
  - utd_snort_ips_engine_software 17.12.3
  - utd_snort_ips_engine_software 17.14.1a
  - utd_snort_ips_engine_software 17.12.3a
  - utd_snort_ips_engine_software 17.12.4
  - utd_snort_ips_engine_software 17.15.1a
  - utd_snort_ips_engine_software 17.16.1a
  - utd_snort_ips_engine_software 17.12.4a
  - utd_snort_ips_engine_software 17.12.4b
  - utd_snort_ips_engine_software 17.12.5
  - utd_snort_ips_engine_software 17.12.5a
  - utd_snort_ips_engine_software 17.12.5b
  - utd_snort_ips_engine_software 17.15.2a
  - utd_snort_ips_engine_software 17.15.2c
  - utd_snort_ips_engine_software 17.15.3
  - utd_snort_ips_engine_software 17.15.3a
  - utd_snort_ips_engine_software 17.17.1
  - utd_snort_ips_engine_software 17.12.5c
  - utd_snort_ips_engine_software 17.15.4
  - utd_snort_ips_engine_software 17.18.1a
  - utd_snort_ips_engine_software 17.12.6
  - utd_snort_ips_engine_software 17.15.4c
  - utd_snort_ips_engine_software 17.12.5d
  - utd_snort_ips_engine_software 17.18.2
published: '2026-01-07'
updated: '2026-02-10'
sourceUpdated: '2026-02-10T20:42:07+00:00'
source: CSAF
sourceUrl: >-
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-dcerpc-vulns-J9HNF4tH
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-dcerpc-vulns-J9HNF4tH
  - url: 'https://software.cisco.com'
tags:
  - csaf
  - vendor-advisory
  - cisco
epss: 0.00666
epssPercentile: 0.50829
ingestedAt: '2026-10-17T11:57:30.518Z'
---

## Overview

Multiple Cisco products are affected by vulnerabilities in the processing of Distributed Computing Environment Remote Procedure Call (DCE/RPC) requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive information or to restart, which would result in an interruption of packet inspection.

For more information about these vulnerabilities, see the Details ["#details"] section of this advisory.

Cisco has released software updates that address these vulnerabilities. There are workarounds that address these vulnerabilities.

## Vendor advisories

- **cisco-sa-snort3-dcerpc-vulns-J9HNF4tH** · Cisco · affected: Cisco Firepower 2100 Series, Cisco Firepower 1000 Series, Cisco ASA 5500-X Series Firewalls, Cisco 3000 Series Industrial Security Appliances (ISA), Cisco Firepower 9000 Series, Cisco Firepower 4100 Series, … · updated 2026-02-10 · [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-dcerpc-vulns-J9HNF4tH)

**Multiple Cisco Products Snort 3 Distributed Computing Environment/Remote Procedure Call Vulnerabilities**. Released 2026-01-07, updated 2026-02-10.

Affected:

- Cisco Firepower 2100 Series
- Cisco Firepower 1000 Series
- Cisco ASA 5500-X Series Firewalls
- Cisco 3000 Series Industrial Security Appliances (ISA)
- Cisco Firepower 9000 Series
- Cisco Firepower 4100 Series
- Cisco Secure Firewall Threat Defense Virtual
- Cisco Secure Firewall 3100 Series
- Cisco Secure Firewall 4200 Series
- Cisco Secure Firewall 1200 Series
- Cisco UTD SNORT IPS Engine Software 17.12.1a
- Cisco UTD SNORT IPS Engine Software 17.12.2
- Cisco UTD SNORT IPS Engine Software 17.13.1a
- Cisco UTD SNORT IPS Engine Software 17.12.3
- Cisco UTD SNORT IPS Engine Software 17.14.1a
- Cisco UTD SNORT IPS Engine Software 17.12.3a
- Cisco UTD SNORT IPS Engine Software 17.12.4
- Cisco UTD SNORT IPS Engine Software 17.15.1a
- Cisco UTD SNORT IPS Engine Software 17.16.1a
- Cisco UTD SNORT IPS Engine Software 17.12.4a
- Cisco UTD SNORT IPS Engine Software 17.12.4b
- Cisco UTD SNORT IPS Engine Software 17.12.5
- Cisco UTD SNORT IPS Engine Software 17.12.5a
- Cisco UTD SNORT IPS Engine Software 17.12.5b
- Cisco UTD SNORT IPS Engine Software 17.15.2a
- Cisco UTD SNORT IPS Engine Software 17.15.2c
- Cisco UTD SNORT IPS Engine Software 17.15.3
- Cisco UTD SNORT IPS Engine Software 17.15.3a
- Cisco UTD SNORT IPS Engine Software 17.17.1
- Cisco UTD SNORT IPS Engine Software 17.12.5c
- Cisco UTD SNORT IPS Engine Software 17.15.4
- Cisco UTD SNORT IPS Engine Software 17.18.1a
- Cisco UTD SNORT IPS Engine Software 17.12.6
- Cisco UTD SNORT IPS Engine Software 17.15.4c
- Cisco UTD SNORT IPS Engine Software 17.12.5d
- Cisco UTD SNORT IPS Engine Software 17.18.2

## Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com