Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities

published 2026-10-21 18 d ago modified 2026-10-22 17 d ago also EUVD-2026-107378

cvss: 5.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits: 0; none known

Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine.

This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required.

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 18 d ago (2026-10-22)

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Affected products

Cisco Cisco Cyber Vision
Cisco Cisco Open Source Snort3
Cisco Cisco Secure Firewall Threat Defense (FTD) Software
Cisco Cisco Umbrella Insights Virtual Appliance
Cisco Cisco UTD SNORT IPS Engine Software

Classification

Weakness

CWE-476 NULL Pointer Dereference

References

sec.cloudapps.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gre-JNpMHrTv

Sources

CVE List CVE-2026-20221
NVD CVE-2026-20221

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary