Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Cisco patches Snort 3 flaws that restart the detection engine

2 sources · 7 articlesFirst reported Updated ()1 · 1 read
What's new

October 21: Cisco detailed unauthenticated Snort 3 restarts via VBA, GRE, GTP, and SMTP, shipped updates, and said no workarounds exist. Cisco calls the VBA flaw denial of service, not code execution.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Cisco shipped updates for unauthenticated Snort 3 flaws that restart the detection engine; ZDI calls the VBA bug remote code execution.

On October 21, 2026, Cisco published advisories for multiple Snort 3 flaws affecting multiple Cisco products. An unauthenticated remote attacker can force the Snort 3 Detection Engine to restart, causing a denial of service, by sending crafted VBA data, nested GRE traffic, a fragmented UDP datagram with GTP extension headers, or crafted SMTP packets on an established connection. Nested GRE can instead cause a detection bypass, depending on configuration, and the GTP case can put the engine in an infinite loop. Cisco says it released software updates and that no workarounds address the issues. ZDI rates the VBA stack overflow, CVE-2026-20218, at CVSS 8.1 and says it allows remote code execution; Cisco says that flaw causes denial of service, not code execution.

Key facts
  • Unauthenticated remote attackers can restart the Snort 3 Detection Engine.
  • Triggers include crafted VBA, nested GRE, fragmented UDP with GTP headers, and SMTP MIME.
  • GRE can cause detection bypass or denial of service, depending on configuration.
  • Cisco released software updates and says no workarounds address the issues.
  • ZDI tracks the VBA stack overflow as CVE-2026-20218 with CVSS 8.1.
  • Cisco says the VBA result is denial of service, not code execution.
Analyze CVE-2026-20218 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026Cisco publishes multiple Snort 3 denial-of-service advisories and updates. · Cisco Security Advisories
  2. Oct 22, 2026ZDI rates the VBA stack overflow as remote code execution. · ZDI Published Advisories

What each outlet adds

beyond the shared facts
  • Cisco Security AdvisoriesVBA overflow is denial of service, not code execution.
  • Cisco Security AdvisoriesNested GRE can bypass detection or cause denial of service.
  • Cisco Security AdvisoriesGTP header handling can put the engine in an infinite loop.
  • Cisco Security AdvisoriesSMTP MIME flaw has updates and no workarounds.
  • ZDI Published AdvisoriesAssigns CVE-2026-20218 and CVSS 8.1 for VBA remote code execution.
CVEs
CVE-2026-20218CVE-2026-20043
Vendors
Cisco
Products
SnortSnort 3Snort 3 Detection Engine
Organizations
Zero Day Initiative

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Cisco Security AdvisoriesFirst report

    Snort 3 flaws in multiple Cisco products can cause denial of service

    Unauthenticated remote attackers can force the Snort 3 Detection Engine to restart; Cisco shipped updates and has no workarounds.

  2. · 4d ago Cisco Security Advisories

    Cisco ships Snort 3 hardening for CVE-2026-20043 out-of-bounds writes

    An internal Snort 3 review grouped multiple out-of-bounds write issues, CWE-787, under CVE-2026-20043.

  3. · 4d ago Cisco Security Advisories

    Snort 3 GTP header flaw can restart Cisco detection engines

    A crafted fragmented UDP datagram with GTP extension headers can put the Snort 3 Detection Engine into an infinite loop.

  4. · 4d ago Cisco Security Advisories

    Cisco Snort 3 SMTP MIME flaw can restart the detection engine

    An unauthenticated attacker can send crafted SMTP packets that make Snort 3 restart; Cisco has updates and no workarounds.

  5. · 4d ago Cisco Security Advisories

    Cisco Snort 3 GRE flaw can restart the detection engine

    Crafted nested GRE traffic can reload Snort 3 and cause either detection bypass or denial of service, depending on configuration.

  6. · 4d ago Cisco Security Advisories

    Snort 3 VBA decompression bug can crash Cisco detection engines

    Crafted VBA data can overflow stack data and restart the Snort 3 Detection Engine; Cisco has released updates.

  7. · 3d ago ZDI Published Advisories

    Cisco Snort OLE VBA bug allows unauthenticated remote code execution

    ZDI rates stack-overflow CVE-2026-20218 at CVSS 8.1 and says authentication is not required.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-20043
Out-of-bounds write in Cisco open-source Snort 3
9.0—
CVE-2026-20218
A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote…
5.8—