---
id: CVE-2026-20054
title: "Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. \r\n\r\nThis vulnerability is due to improper error …"
summary: "Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. \r\n\r\nThis vulnerability is due to improper error …"
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L'
cwe:
  - CWE-835
vendor: cisco
product: snort
affected:
  - 'snort >= 3.0.0-233, < 3.9.3.0'
  - cyber_vision = 3.0.0
  - cyber_vision = 3.0.1
  - cyber_vision = 3.0.2
  - cyber_vision = 3.0.3
  - cyber_vision = 3.0.4
  - cyber_vision = 3.0.5
  - cyber_vision = 3.0.6
  - cyber_vision = 3.1.0
  - cyber_vision = 3.1.1
  - cyber_vision = 3.1.2
  - cyber_vision = 3.2.0
  - cyber_vision = 3.2.1
  - cyber_vision = 3.2.2
  - cyber_vision = 3.2.3
  - cyber_vision = 3.2.4
  - cyber_vision = 4.0.0
  - cyber_vision = 4.0.1
  - cyber_vision = 4.0.2
  - cyber_vision = 4.0.3
  - cyber_vision = 4.1.0
  - cyber_vision = 4.1.1
  - cyber_vision = 4.1.2
  - cyber_vision = 4.1.3
  - cyber_vision = 4.1.4
  - cyber_vision = 4.1.5
  - cyber_vision = 4.1.6
  - cyber_vision = 4.1.7
  - cyber_vision = 4.2.0
  - cyber_vision = 4.2.1
  - cyber_vision = 4.2.2
  - cyber_vision = 4.2.3
  - cyber_vision = 4.2.4
  - cyber_vision = 4.2.6
  - cyber_vision = 4.3.0
  - cyber_vision = 4.3.1
  - cyber_vision = 4.3.2
  - cyber_vision = 4.3.3
  - cyber_vision = 4.4.0
  - cyber_vision = 4.4.1
  - cyber_vision = 4.4.2
  - cyber_vision = 4.4.3
  - cyber_vision = 5.0.0
  - cyber_vision = 5.0.1
  - cyber_vision = 5.0.2
  - cyber_vision = 5.1.0
  - cyber_vision = 5.1.1
  - cyber_vision = 5.1.2
  - cyber_vision = 5.1.3
  - cyber_vision = 5.2.0
  - cyber_vision = 5.2.1
  - cyber_vision = 5.3.0
  - cyber_vision = 5.3.1
  - cyber_vision = 5.3.2
  - secure_firewall_threat_defense = 7.2.0
  - secure_firewall_threat_defense = 7.2.0.1
  - secure_firewall_threat_defense = 7.2.1
  - secure_firewall_threat_defense = 7.2.2
  - secure_firewall_threat_defense = 7.2.3
  - secure_firewall_threat_defense = 7.2.4
  - secure_firewall_threat_defense = 7.2.4.1
  - secure_firewall_threat_defense = 7.2.5
  - secure_firewall_threat_defense = 7.2.5.1
  - secure_firewall_threat_defense = 7.2.5.2
  - secure_firewall_threat_defense = 7.2.6
  - secure_firewall_threat_defense = 7.2.7
  - secure_firewall_threat_defense = 7.2.8
  - secure_firewall_threat_defense = 7.2.8.1
  - secure_firewall_threat_defense = 7.2.9
  - secure_firewall_threat_defense = 7.2.10
  - secure_firewall_threat_defense = 7.2.10.2
  - secure_firewall_threat_defense = 7.3.0
  - secure_firewall_threat_defense = 7.3.1
  - secure_firewall_threat_defense = 7.3.1.1
  - secure_firewall_threat_defense = 7.3.1.2
  - secure_firewall_threat_defense = 7.4.0
  - secure_firewall_threat_defense = 7.4.1
  - secure_firewall_threat_defense = 7.4.1.1
  - secure_firewall_threat_defense = 7.4.2
  - secure_firewall_threat_defense = 7.4.2.1
  - secure_firewall_threat_defense = 7.4.2.2
  - secure_firewall_threat_defense = 7.4.2.3
  - secure_firewall_threat_defense = 7.4.2.4
  - secure_firewall_threat_defense = 7.4.3
  - secure_firewall_threat_defense = 7.6.0
  - secure_firewall_threat_defense = 7.6.1
  - secure_firewall_threat_defense = 7.6.2
  - secure_firewall_threat_defense = 7.6.2.1
  - secure_firewall_threat_defense = 7.7.0
  - secure_firewall_threat_defense = 7.7.10
  - secure_firewall_threat_defense = 7.7.10.1
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 3.17.0s
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 3.17.1s
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.1
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.5
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.6
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.7a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.9
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.10
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 16.12.1a
patched:
  - snort 3.9.3.0
published: '2026-03-04'
updated: '2026-08-20'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-20054'
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed
    label: psirt@cisco.com
tags:
  - nvd
epss: 0.00432
epssPercentile: 0.34921
ingestedAt: '2026-08-20T17:59:04.158Z'
---

## Overview

Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.&nbsp;

This vulnerability is due to improper error checking when decompressing VBA data. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to enter an infinite loop, causing a DoS condition.

## Affected

- `snort >= 3.0.0-233, < 3.9.3.0`
- `cyber_vision = 3.0.0`
- `cyber_vision = 3.0.1`
- `cyber_vision = 3.0.2`
- `cyber_vision = 3.0.3`
- `cyber_vision = 3.0.4`
- `cyber_vision = 3.0.5`
- `cyber_vision = 3.0.6`
- `cyber_vision = 3.1.0`
- `cyber_vision = 3.1.1`
- `cyber_vision = 3.1.2`
- `cyber_vision = 3.2.0`
- `cyber_vision = 3.2.1`
- `cyber_vision = 3.2.2`
- `cyber_vision = 3.2.3`
- `cyber_vision = 3.2.4`
- `cyber_vision = 4.0.0`
- `cyber_vision = 4.0.1`
- `cyber_vision = 4.0.2`
- `cyber_vision = 4.0.3`
- `cyber_vision = 4.1.0`
- `cyber_vision = 4.1.1`
- `cyber_vision = 4.1.2`
- `cyber_vision = 4.1.3`
- `cyber_vision = 4.1.4`
- `cyber_vision = 4.1.5`
- `cyber_vision = 4.1.6`
- `cyber_vision = 4.1.7`
- `cyber_vision = 4.2.0`
- `cyber_vision = 4.2.1`
- `cyber_vision = 4.2.2`
- `cyber_vision = 4.2.3`
- `cyber_vision = 4.2.4`
- `cyber_vision = 4.2.6`
- `cyber_vision = 4.3.0`
- `cyber_vision = 4.3.1`
- `cyber_vision = 4.3.2`
- `cyber_vision = 4.3.3`
- `cyber_vision = 4.4.0`
- `cyber_vision = 4.4.1`
- `cyber_vision = 4.4.2`
- `cyber_vision = 4.4.3`
- `cyber_vision = 5.0.0`
- `cyber_vision = 5.0.1`
- `cyber_vision = 5.0.2`
- `cyber_vision = 5.1.0`
- `cyber_vision = 5.1.1`
- `cyber_vision = 5.1.2`
- `cyber_vision = 5.1.3`
- `cyber_vision = 5.2.0`
- `cyber_vision = 5.2.1`
- `cyber_vision = 5.3.0`
- `cyber_vision = 5.3.1`
- `cyber_vision = 5.3.2`
- `secure_firewall_threat_defense = 7.2.0`
- `secure_firewall_threat_defense = 7.2.0.1`
- `secure_firewall_threat_defense = 7.2.1`
- `secure_firewall_threat_defense = 7.2.2`
- `secure_firewall_threat_defense = 7.2.3`
- `secure_firewall_threat_defense = 7.2.4`
- `secure_firewall_threat_defense = 7.2.4.1`
- `secure_firewall_threat_defense = 7.2.5`
- `secure_firewall_threat_defense = 7.2.5.1`
- `secure_firewall_threat_defense = 7.2.5.2`
- `secure_firewall_threat_defense = 7.2.6`
- `secure_firewall_threat_defense = 7.2.7`
- `secure_firewall_threat_defense = 7.2.8`
- `secure_firewall_threat_defense = 7.2.8.1`
- `secure_firewall_threat_defense = 7.2.9`
- `secure_firewall_threat_defense = 7.2.10`
- `secure_firewall_threat_defense = 7.2.10.2`
- `secure_firewall_threat_defense = 7.3.0`
- `secure_firewall_threat_defense = 7.3.1`
- `secure_firewall_threat_defense = 7.3.1.1`
- `secure_firewall_threat_defense = 7.3.1.2`
- `secure_firewall_threat_defense = 7.4.0`
- `secure_firewall_threat_defense = 7.4.1`
- `secure_firewall_threat_defense = 7.4.1.1`
- `secure_firewall_threat_defense = 7.4.2`
- `secure_firewall_threat_defense = 7.4.2.1`
- `secure_firewall_threat_defense = 7.4.2.2`
- `secure_firewall_threat_defense = 7.4.2.3`
- `secure_firewall_threat_defense = 7.4.2.4`
- `secure_firewall_threat_defense = 7.4.3`
- `secure_firewall_threat_defense = 7.6.0`
- `secure_firewall_threat_defense = 7.6.1`
- `secure_firewall_threat_defense = 7.6.2`
- `secure_firewall_threat_defense = 7.6.2.1`
- `secure_firewall_threat_defense = 7.7.0`
- `secure_firewall_threat_defense = 7.7.10`
- `secure_firewall_threat_defense = 7.7.10.1`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 3.17.0s`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 3.17.1s`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.1`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.5`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.6`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.7a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.9`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.10`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 16.12.1a`

## Remediation

Upgrade past the affected range:

- `snort 3.9.3.0`