---
id: CVE-2026-20221
title: >-
  Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of
  Service Vulnerabilities
summary: >-
  Multiple Cisco products are affected by a vulnerability in the generic routing
  encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection
  Engine that could allow an unauthenticated, remote attacker to cause an
  unexpected r…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-476
vendor: Cisco
product: Cisco Cyber Vision
affected:
  - cyber_vision 3.0.0
  - cyber_vision 3.0.2
  - cyber_vision 3.0.3
  - cyber_vision 3.0.1
  - cyber_vision 3.1.0
  - cyber_vision 3.0.4
  - cyber_vision 3.1.1
  - cyber_vision 3.1.2
  - cyber_vision 3.2.0
  - cyber_vision 3.0.5
  - cyber_vision 3.2.1
  - cyber_vision 3.0.6
  - cyber_vision 3.2.2
  - cyber_vision 3.2.3
  - cyber_vision 3.2.4
  - cyber_vision 4.0.0
  - cyber_vision 4.0.1
  - cyber_vision 4.0.2
  - cyber_vision 4.0.3
  - cyber_vision 4.1.0
  - cyber_vision 4.1.1
  - cyber_vision 4.1.2
  - cyber_vision 4.1.3
  - cyber_vision 4.1.4
  - cyber_vision 4.2.0
  - cyber_vision 4.2.1
  - cyber_vision 4.1.5
  - cyber_vision 4.2.2
  - cyber_vision 4.2.X
  - cyber_vision 4.2.3
  - cyber_vision 4.2.4
  - cyber_vision 4.2.6
  - cyber_vision 4.1.6
  - cyber_vision 4.3.0
  - cyber_vision 4.3.1
  - cyber_vision 4.3.2
  - cyber_vision 4.3.3
  - cyber_vision 4.4.0
  - cyber_vision 4.4.1
  - cyber_vision 4.4.2
  - cyber_vision 4.4.3
  - cyber_vision 4.1.7
  - cyber_vision 5.0.0
  - cyber_vision 5.0.1
  - cyber_vision 5.0.2
  - cyber_vision 5.1.0
  - cyber_vision 5.1.1
  - cyber_vision 5.1.2
  - cyber_vision 5.1.3
  - cyber_vision 5.2.0
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T16:12:53.435Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-20221'
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gre-JNpMHrTv
    label: cisco-sa-snort3-gre-JNpMHrTv
tags:
  - cve.org
ingestedAt: '2026-10-21T17:07:51.305Z'
---

## Overview

Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine.

This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the  section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required.

## Affected

- `cyber_vision 3.0.0`
- `cyber_vision 3.0.2`
- `cyber_vision 3.0.3`
- `cyber_vision 3.0.1`
- `cyber_vision 3.1.0`
- `cyber_vision 3.0.4`
- `cyber_vision 3.1.1`
- `cyber_vision 3.1.2`
- `cyber_vision 3.2.0`
- `cyber_vision 3.0.5`
- `cyber_vision 3.2.1`
- `cyber_vision 3.0.6`
- `cyber_vision 3.2.2`
- `cyber_vision 3.2.3`
- `cyber_vision 3.2.4`
- `cyber_vision 4.0.0`
- `cyber_vision 4.0.1`
- `cyber_vision 4.0.2`
- `cyber_vision 4.0.3`
- `cyber_vision 4.1.0`
- `cyber_vision 4.1.1`
- `cyber_vision 4.1.2`
- `cyber_vision 4.1.3`
- `cyber_vision 4.1.4`
- `cyber_vision 4.2.0`
- `cyber_vision 4.2.1`
- `cyber_vision 4.1.5`
- `cyber_vision 4.2.2`
- `cyber_vision 4.2.X`
- `cyber_vision 4.2.3`
- `cyber_vision 4.2.4`
- `cyber_vision 4.2.6`
- `cyber_vision 4.1.6`
- `cyber_vision 4.3.0`
- `cyber_vision 4.3.1`
- `cyber_vision 4.3.2`
- `cyber_vision 4.3.3`
- `cyber_vision 4.4.0`
- `cyber_vision 4.4.1`
- `cyber_vision 4.4.2`
- `cyber_vision 4.4.3`
- `cyber_vision 4.1.7`
- `cyber_vision 5.0.0`
- `cyber_vision 5.0.1`
- `cyber_vision 5.0.2`
- `cyber_vision 5.1.0`
- `cyber_vision 5.1.1`
- `cyber_vision 5.1.2`
- `cyber_vision 5.1.3`
- `cyber_vision 5.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.