Cisco Open Source Snort 3: Arbitrary command execution via control channel socket
Summary
Open Source Snort 3 does not authenticate local users who connect to its control channel socket. A local attacker with low privileges can connect to this socket and run arbitrary commands as the Snort 3 process user. The attacker could also read and write the Snort 3 process memory. Exposure is local only, so the risk is highest on shared hosts and multi-user systems.
Affected
- Open Source Snort 3 (Cisco advisory and CVE record list 3.1.2.0 to 3.1.13.0 and 3.12.2.0; the full affected range must be checked in the Cisco advisory table)
- Snort 3 components in Cisco products: the fixed releases differ per product, see the Cisco advisory
- Open Source Snort 2 is not affected
Fixed in
- Open Source Snort 3: 3.12.4.0 or later
- Cisco UTD on IOS XE: images contain Snort 3.12.4.0
- Meraki MX: online devices connected to the Meraki Dashboard were updated automatically as of October 21, 2026
- Other Cisco products: check the product tables in the Cisco advisory
Workaround
No workarounds available according to Cisco.
- General hardening, not endorsed by Cisco: restrict local access to the Snort control channel socket to authorised users only
- Run Snort 3 with the minimum necessary privileges
- These measures do not replace the patch
Exploitation
- Cisco PSIRT is not aware of any public announcements or malicious use.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof-of-concept found in the research.
- No CISA KEV listing found; re-check the KEV catalog to confirm.
Our recommendation
- Inventory all Snort 3 instances, including standalone hosts, Firewall Threat Defense, Meraki MX, Cyber Vision and IOS XE UTD.
- Upgrade standalone Snort 3 to 3.12.4.0 or later and upgrade Cisco appliances according to their advisory tables.
- Review local shell accounts on Snort hosts and remove those that are not needed.
- Restrict who can log in locally on Snort hosts.
- Re-check the Cisco advisory and the CISA KEV catalog for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory cisco-sa-opensrc-snort3-2fXGJPfe sec.cloudapps.cisco.com
- Cisco Security Advisory: Snort 3 Security Hardening Release October 2026 www.cisco.com
- Cisco Security Advisory notice (October 2026 Snort 3 bundle) sec.cloudapps.cisco.com
- Feedly CVE-2026-76524 feedly.com
- VulDB entry 424918 vuldb.com
- SecurityOnline: Cisco Snort 3 vulnerabilities October 2026 securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:47.
Original description (NVD)
A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.