Cisco Snort 3: Out-of-bounds write in intrusion prevention engine

Summary

Cisco's Snort 3 intrusion prevention engine, used in several Cisco firewall, cloud, Meraki MX, Cyber Vision and IOS XE products, contains out-of-bounds write vulnerabilities (CWE-787) found in an internal review. Cisco has not published the technical details. The CVSS vector rates the attack as network-reachable without privileges or user interaction but with high complexity, and the impact as high on confidentiality, integrity and availability. Cisco has not confirmed the exact effect.

Affected

• Open Source Snort 3 (affected releases per advisory; Snort 2 is not affected)
• Cisco Secure Firewall Threat Defense (FTD) Software
• Cisco Cyber Vision
• Cisco Meraki MX Security Appliances
• Unified Threat Defense (UTD) on Cisco IOS XE Software
• Cisco Cloud-delivered Firewall (CDFW) and Cisco Secure Access (CSA): cloud services, no customer action needed

Fixed in

• Open Source Snort 3: 3.12.4.0
• Cisco Cyber Vision: 5.6.0 (earlier releases must be migrated to a fixed release)
• FTD, UTD on IOS XE: check the first fixed release for your train in the Cisco advisory; versions in third-party sources are unverified
• CDFW and CSA: already updated automatically by Cisco as of October 21, 2026
• Meraki MX: online devices were updated automatically

Workaround

• None. Cisco states there are no workarounds for these vulnerabilities. Patching is the only remediation.

Exploitation

• Cisco PSIRT is not aware of any public announcements or malicious use.
• Not listed as known exploited.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found.

Our recommendation

• Inventory all Snort 3 deployments, including FTD, Meraki MX, Cyber Vision, IOS XE UTD and open-source Snort builds.
• Map each device to its fixed release in the Cisco advisory, not in third-party tables.
• Patch internet-facing firewalls and Meraki devices first and plan a maintenance window, because the engine restarts during the upgrade.
• Monitor the Cisco advisory for updates, as Cisco has said more details may follow.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Security Advisory cisco-sa-hardening-snort3-ybgmhTQe sec.cloudapps.cisco.com
• Cisco Security Advisory cisco-sa-hardening-snort3-ybgmhTQe (Cisco support docs) www.cisco.com
• Snort 2 end-of-life announcement blog.snort.org
• VulDB entry 424878 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:05.