---
id: CVE-2026-20058
title: "Multiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.\r\n\r\nThese vulnerabilities are due to improper error ch…"
summary: "Multiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.\r\n\r\nThese vulnerabilities are due to improper error ch…"
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L'
cwe:
  - CWE-786
vendor: cisco
product: snort
affected:
  - 'snort >= 3.0.0-233, < 3.9.6.0'
  - secure_firewall_threat_defense = 7.2.0
  - secure_firewall_threat_defense = 7.2.0.1
  - secure_firewall_threat_defense = 7.2.1
  - secure_firewall_threat_defense = 7.2.2
  - secure_firewall_threat_defense = 7.2.3
  - secure_firewall_threat_defense = 7.2.4
  - secure_firewall_threat_defense = 7.2.4.1
  - secure_firewall_threat_defense = 7.2.5
  - secure_firewall_threat_defense = 7.2.5.1
  - secure_firewall_threat_defense = 7.2.5.2
  - secure_firewall_threat_defense = 7.2.6
  - secure_firewall_threat_defense = 7.2.7
  - secure_firewall_threat_defense = 7.2.8
  - secure_firewall_threat_defense = 7.2.8.1
  - secure_firewall_threat_defense = 7.2.9
  - secure_firewall_threat_defense = 7.2.10
  - secure_firewall_threat_defense = 7.2.10.2
  - secure_firewall_threat_defense = 7.3.0
  - secure_firewall_threat_defense = 7.3.1
  - secure_firewall_threat_defense = 7.3.1.1
  - secure_firewall_threat_defense = 7.3.1.2
  - secure_firewall_threat_defense = 7.4.0
  - secure_firewall_threat_defense = 7.4.1
  - secure_firewall_threat_defense = 7.4.1.1
  - secure_firewall_threat_defense = 7.4.2
  - secure_firewall_threat_defense = 7.4.2.1
  - secure_firewall_threat_defense = 7.4.2.2
  - secure_firewall_threat_defense = 7.4.2.3
  - secure_firewall_threat_defense = 7.4.2.4
  - secure_firewall_threat_defense = 7.4.3
  - secure_firewall_threat_defense = 7.6.0
  - secure_firewall_threat_defense = 7.6.1
  - secure_firewall_threat_defense = 7.6.2
  - secure_firewall_threat_defense = 7.6.2.1
  - secure_firewall_threat_defense = 7.7.0
  - secure_firewall_threat_defense = 7.7.10
  - secure_firewall_threat_defense = 7.7.10.1
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.3a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.6
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4b
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5b
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5c
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5d
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.6
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.13.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.14.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2c
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4c
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.16.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.17.1
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.2
patched:
  - snort 3.9.6.0
published: '2026-03-04'
updated: '2026-08-20'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-20058'
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed
    label: psirt@cisco.com
tags:
  - nvd
epss: 0.0039
epssPercentile: 0.30242
ingestedAt: '2026-08-20T17:59:04.238Z'
---

## Overview

Multiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.

These vulnerabilities are due to improper error checking when decompressing VBA data. An attacker could exploit these vulnerabilities by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to unexpectedly restart, causing a DoS condition.

## Affected

- `snort >= 3.0.0-233, < 3.9.6.0`
- `secure_firewall_threat_defense = 7.2.0`
- `secure_firewall_threat_defense = 7.2.0.1`
- `secure_firewall_threat_defense = 7.2.1`
- `secure_firewall_threat_defense = 7.2.2`
- `secure_firewall_threat_defense = 7.2.3`
- `secure_firewall_threat_defense = 7.2.4`
- `secure_firewall_threat_defense = 7.2.4.1`
- `secure_firewall_threat_defense = 7.2.5`
- `secure_firewall_threat_defense = 7.2.5.1`
- `secure_firewall_threat_defense = 7.2.5.2`
- `secure_firewall_threat_defense = 7.2.6`
- `secure_firewall_threat_defense = 7.2.7`
- `secure_firewall_threat_defense = 7.2.8`
- `secure_firewall_threat_defense = 7.2.8.1`
- `secure_firewall_threat_defense = 7.2.9`
- `secure_firewall_threat_defense = 7.2.10`
- `secure_firewall_threat_defense = 7.2.10.2`
- `secure_firewall_threat_defense = 7.3.0`
- `secure_firewall_threat_defense = 7.3.1`
- `secure_firewall_threat_defense = 7.3.1.1`
- `secure_firewall_threat_defense = 7.3.1.2`
- `secure_firewall_threat_defense = 7.4.0`
- `secure_firewall_threat_defense = 7.4.1`
- `secure_firewall_threat_defense = 7.4.1.1`
- `secure_firewall_threat_defense = 7.4.2`
- `secure_firewall_threat_defense = 7.4.2.1`
- `secure_firewall_threat_defense = 7.4.2.2`
- `secure_firewall_threat_defense = 7.4.2.3`
- `secure_firewall_threat_defense = 7.4.2.4`
- `secure_firewall_threat_defense = 7.4.3`
- `secure_firewall_threat_defense = 7.6.0`
- `secure_firewall_threat_defense = 7.6.1`
- `secure_firewall_threat_defense = 7.6.2`
- `secure_firewall_threat_defense = 7.6.2.1`
- `secure_firewall_threat_defense = 7.7.0`
- `secure_firewall_threat_defense = 7.7.10`
- `secure_firewall_threat_defense = 7.7.10.1`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.3a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.6`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4b`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5b`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5c`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5d`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.6`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.13.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.14.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2c`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4c`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.16.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.17.1`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.2`

## Remediation

Upgrade past the affected range:

- `snort 3.9.6.0`