Vulnerability in Cisco Open Source Snort3

[ Description ]Official description

A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL22 Oct 2026NCSC-2026-0450

  Vulnerabilities fixed in Snort 3 from Cisco Translated from Dutch

  Probability/damage M/HCVE-2026-20011CVE-2026-20019CVE-2026-20043+10 more CVEs
• CERT-FR22 Oct 2026CERTFR-2026-AVI-1360

  Multiple vulnerabilities in Cisco products Translated from French

  Multiple vulnerabilities have been discovered in Cisco products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-20356CVE-2026-76481CVE-2026-76524+23 more CVEs
• BSI CERT-Bund21 Oct 2026WID-SEC-2026-4104

  Cisco products (IOS XE, SFTD) and Snort: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-20236CVE-2026-20011CVE-2026-20356+10 more CVEs

[ References ]References

• sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-opensrc-…