--- id: CVE-2026-20057 title: "Multiple Cisco products are affected by a vulnerability in the Snort 3 Visual Basic for Applications (VBA) feature which could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. \r\n \r\nThis …" summary: "Multiple Cisco products are affected by a vulnerability in the Snort 3 Visual Basic for Applications (VBA) feature which could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. \r\n \r\nThis …" severity: medium cvss: 5.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L' cwe: - CWE-369 vendor: cisco product: snort affected: - 'snort >= 3.0.0-233, < 3.9.3.0' - cyber_vision = 3.0.0 - cyber_vision = 3.0.1 - cyber_vision = 3.0.2 - cyber_vision = 3.0.3 - cyber_vision = 3.0.4 - cyber_vision = 3.0.5 - cyber_vision = 3.0.6 - cyber_vision = 3.1.0 - cyber_vision = 3.1.1 - cyber_vision = 3.1.2 - cyber_vision = 3.2.0 - cyber_vision = 3.2.1 - cyber_vision = 3.2.2 - cyber_vision = 3.2.3 - cyber_vision = 3.2.4 - cyber_vision = 4.0.0 - cyber_vision = 4.0.1 - cyber_vision = 4.0.2 - cyber_vision = 4.0.3 - cyber_vision = 4.1.0 - cyber_vision = 4.1.1 - cyber_vision = 4.1.2 - cyber_vision = 4.1.3 - cyber_vision = 4.1.4 - cyber_vision = 4.1.5 - cyber_vision = 4.1.6 - cyber_vision = 4.1.7 - cyber_vision = 4.2.0 - cyber_vision = 4.2.1 - cyber_vision = 4.2.2 - cyber_vision = 4.2.3 - cyber_vision = 4.2.4 - cyber_vision = 4.2.6 - cyber_vision = 4.3.0 - cyber_vision = 4.3.1 - cyber_vision = 4.3.2 - cyber_vision = 4.3.3 - cyber_vision = 4.4.0 - cyber_vision = 4.4.1 - cyber_vision = 4.4.2 - cyber_vision = 4.4.3 - cyber_vision = 5.0.0 - cyber_vision = 5.0.1 - cyber_vision = 5.0.2 - cyber_vision = 5.1.0 - cyber_vision = 5.1.1 - cyber_vision = 5.1.2 - cyber_vision = 5.1.3 - cyber_vision = 5.2.0 - cyber_vision = 5.2.1 - cyber_vision = 5.3.0 - cyber_vision = 5.3.1 - secure_firewall_threat_defense = 7.2.0 - secure_firewall_threat_defense = 7.2.0.1 - secure_firewall_threat_defense = 7.2.1 - secure_firewall_threat_defense = 7.2.2 - secure_firewall_threat_defense = 7.2.3 - secure_firewall_threat_defense = 7.2.4 - secure_firewall_threat_defense = 7.2.4.1 - secure_firewall_threat_defense = 7.2.5 - secure_firewall_threat_defense = 7.2.5.1 - secure_firewall_threat_defense = 7.2.5.2 - secure_firewall_threat_defense = 7.2.6 - secure_firewall_threat_defense = 7.2.7 - secure_firewall_threat_defense = 7.2.8 - secure_firewall_threat_defense = 7.2.8.1 - secure_firewall_threat_defense = 7.2.9 - secure_firewall_threat_defense = 7.2.10 - secure_firewall_threat_defense = 7.2.10.2 - secure_firewall_threat_defense = 7.3.0 - secure_firewall_threat_defense = 7.3.1 - secure_firewall_threat_defense = 7.3.1.1 - secure_firewall_threat_defense = 7.3.1.2 - secure_firewall_threat_defense = 7.4.0 - secure_firewall_threat_defense = 7.4.1 - secure_firewall_threat_defense = 7.4.1.1 - secure_firewall_threat_defense = 7.4.2 - secure_firewall_threat_defense = 7.4.2.1 - secure_firewall_threat_defense = 7.4.2.2 - secure_firewall_threat_defense = 7.4.2.3 - secure_firewall_threat_defense = 7.4.2.4 - secure_firewall_threat_defense = 7.4.3 - secure_firewall_threat_defense = 7.6.0 - secure_firewall_threat_defense = 7.6.1 - secure_firewall_threat_defense = 7.6.2 - secure_firewall_threat_defense = 7.6.2.1 - secure_firewall_threat_defense = 7.7.0 - secure_firewall_threat_defense = 7.7.10 - secure_firewall_threat_defense = 7.7.10.1 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4b - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5b patched: - snort 3.9.3.0 published: '2026-03-04' updated: '2026-08-20' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-20057' references: - url: >- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed label: psirt@cisco.com tags: - nvd epss: 0.00432 epssPercentile: 0.34921 ingestedAt: '2026-08-20T17:59:04.198Z' --- ## Overview Multiple Cisco products are affected by a vulnerability in the Snort 3 Visual Basic for Applications (VBA) feature which could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.    This vulnerability is due to lack of proper error checking when decompressing VBA data. An attacker could exploit this vulnerability by sending a crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to unexpectedly restart causing a a denial of service (DoS) condition. ## Affected - `snort >= 3.0.0-233, < 3.9.3.0` - `cyber_vision = 3.0.0` - `cyber_vision = 3.0.1` - `cyber_vision = 3.0.2` - `cyber_vision = 3.0.3` - `cyber_vision = 3.0.4` - `cyber_vision = 3.0.5` - `cyber_vision = 3.0.6` - `cyber_vision = 3.1.0` - `cyber_vision = 3.1.1` - `cyber_vision = 3.1.2` - `cyber_vision = 3.2.0` - `cyber_vision = 3.2.1` - `cyber_vision = 3.2.2` - `cyber_vision = 3.2.3` - `cyber_vision = 3.2.4` - `cyber_vision = 4.0.0` - `cyber_vision = 4.0.1` - `cyber_vision = 4.0.2` - `cyber_vision = 4.0.3` - `cyber_vision = 4.1.0` - `cyber_vision = 4.1.1` - `cyber_vision = 4.1.2` - `cyber_vision = 4.1.3` - `cyber_vision = 4.1.4` - `cyber_vision = 4.1.5` - `cyber_vision = 4.1.6` - `cyber_vision = 4.1.7` - `cyber_vision = 4.2.0` - `cyber_vision = 4.2.1` - `cyber_vision = 4.2.2` - `cyber_vision = 4.2.3` - `cyber_vision = 4.2.4` - `cyber_vision = 4.2.6` - `cyber_vision = 4.3.0` - `cyber_vision = 4.3.1` - `cyber_vision = 4.3.2` - `cyber_vision = 4.3.3` - `cyber_vision = 4.4.0` - `cyber_vision = 4.4.1` - `cyber_vision = 4.4.2` - `cyber_vision = 4.4.3` - `cyber_vision = 5.0.0` - `cyber_vision = 5.0.1` - `cyber_vision = 5.0.2` - `cyber_vision = 5.1.0` - `cyber_vision = 5.1.1` - `cyber_vision = 5.1.2` - `cyber_vision = 5.1.3` - `cyber_vision = 5.2.0` - `cyber_vision = 5.2.1` - `cyber_vision = 5.3.0` - `cyber_vision = 5.3.1` - `secure_firewall_threat_defense = 7.2.0` - `secure_firewall_threat_defense = 7.2.0.1` - `secure_firewall_threat_defense = 7.2.1` - `secure_firewall_threat_defense = 7.2.2` - `secure_firewall_threat_defense = 7.2.3` - `secure_firewall_threat_defense = 7.2.4` - `secure_firewall_threat_defense = 7.2.4.1` - `secure_firewall_threat_defense = 7.2.5` - `secure_firewall_threat_defense = 7.2.5.1` - `secure_firewall_threat_defense = 7.2.5.2` - `secure_firewall_threat_defense = 7.2.6` - `secure_firewall_threat_defense = 7.2.7` - `secure_firewall_threat_defense = 7.2.8` - `secure_firewall_threat_defense = 7.2.8.1` - `secure_firewall_threat_defense = 7.2.9` - `secure_firewall_threat_defense = 7.2.10` - `secure_firewall_threat_defense = 7.2.10.2` - `secure_firewall_threat_defense = 7.3.0` - `secure_firewall_threat_defense = 7.3.1` - `secure_firewall_threat_defense = 7.3.1.1` - `secure_firewall_threat_defense = 7.3.1.2` - `secure_firewall_threat_defense = 7.4.0` - `secure_firewall_threat_defense = 7.4.1` - `secure_firewall_threat_defense = 7.4.1.1` - `secure_firewall_threat_defense = 7.4.2` - `secure_firewall_threat_defense = 7.4.2.1` - `secure_firewall_threat_defense = 7.4.2.2` - `secure_firewall_threat_defense = 7.4.2.3` - `secure_firewall_threat_defense = 7.4.2.4` - `secure_firewall_threat_defense = 7.4.3` - `secure_firewall_threat_defense = 7.6.0` - `secure_firewall_threat_defense = 7.6.1` - `secure_firewall_threat_defense = 7.6.2` - `secure_firewall_threat_defense = 7.6.2.1` - `secure_firewall_threat_defense = 7.7.0` - `secure_firewall_threat_defense = 7.7.10` - `secure_firewall_threat_defense = 7.7.10.1` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4b` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5b` ## Remediation Upgrade past the affected range: - `snort 3.9.3.0`