Cisco has disclosed CVE-2026-20043, a critical-rated (CVSS 9.0) group of out-of-bounds write vulnerabilities in Open Source Snort 3 that also affects many Cisco Cyber Vision releases.
What Is It
CVE-2026-20043 covers several out-of-bounds write vulnerabilities, grouped under CWE-787. They came to light during an internal security review by Cisco's Open Source Snort 3 engineering team. That review led to software hardening releases that fix several vulnerabilities Cisco found internally. Cisco has published few technical details beyond the vulnerability class.
NVD published the record on 2026-10-21. Its status is "Awaiting Analysis."
Why It Matters
The CVE carries a CVSS 3.1 base score of 9.0 (Critical) with vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. According to that vector:
- It could be exploited over the network.
- An attacker would need no privileges and no user interaction.
- Attack complexity is rated high.
- The scope is rated as changed, so impact could reach past the vulnerable component.
- A successful attack could fully compromise confidentiality, integrity, and availability.
Snort 3 is an intrusion detection and prevention engine that inspects network traffic. A memory corruption flaw in a component that sits in the traffic path deserves prompt attention.
As of publication, the CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for CVE-2026-20043. The sources cited here do not confirm active exploitation.
What's Vulnerable
According to the Cisco-supplied affected data in the NVD record:
- Cisco Open Source Snort3: many releases are listed as affected, including versions in the 3.1.x line (such as 3.1.2.0 through 3.1.16.0 as enumerated) and 3.12.2.0. The full version list is in the NVD record.
- Cisco Cyber Vision: a wide range of releases across the 3.x, 4.x, and 5.x branches, from 3.0.0 through 5.8.1. Examples include 3.2.4, 4.1.7, 4.4.3, 5.3.3, 5.7.1, and 5.8.1.
The record gives no CPE entries yet.
Patch Status
Cisco says it has issued software hardening releases that address these vulnerabilities. The cited sources do not name the fixed versions. Administrators running Snort 3 or Cisco Cyber Vision should:
- Check the Cisco Security Advisory below for fixed releases and upgrade guidance.
- Prioritize systems that inspect untrusted network traffic.
No CISA KEV required action or due date applies, because the CVE is not in the KEV catalog.