CVE-2026-20052

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20052", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.355Z", "datePublished": "2026-03-04T17:46:57.096Z", "dateUpdated": "2026-03-04T20:46:43.211Z"}, "containers": {"cna": {"title": "Cisco Secure Firewall Threat Defense Software Snort 3 Memory Management Denial of Service Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L", "baseScore": 5.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in the memory management handling for the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart.\r\n\r\nThis vulnerability is due to a logic error in memory management when a device is performing Snort 3 SSL packet inspection. An attacker could exploit this vulnerability by sending crafted SSL packets through an established connection to be parsed by the Snort 3 Detection Engine. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine unexpectedly restarts."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3ssl-FBEKYXpH", "name": "cisco-sa-ftd-snort3ssl-FBEKYXpH"}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-ftd-snort3ssl-FBEKYXpH", "discovery": "INTERNAL", "defects": ["CSCwn63410"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Access of Memory Location After End of Buffer", "type": "cwe", "cweId": "CWE-788"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Secure Firewall Threat Defense (FTD) Software", "versions": [{"version": "7.4.0", "status": "affected"}, {"version": "7.4.1", "status": "affected"}, {"version": "7.4.1.1", "status": "affected"}, {"version": "7.6.0", "status": "affected"}, {"version": "7.4.2", "status": "affected"}, {"version": "7.4.2.1", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-04T17:46:57.096Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T20:46:35.971901Z", "id": "CVE-2026-20052", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T20:46:43.211Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20052", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T20:46:35.971901Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T20:46:39.793Z"}}], "cna": {"title": "Cisco Secure Firewall Threat Defense Software Snort 3 Memory Management Denial of Service Vulnerability", "source": {"defects": ["CSCwn63410"], "advisory": "cisco-sa-ftd-snort3ssl-FBEKYXpH", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Secure Firewall Threat Defense (FTD) Software", "versions": [{"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.4.1.1"}, {"status": "affected", "version": "7.6.0"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.4.2.1"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3ssl-FBEKYXpH", "name": "cisco-sa-ftd-snort3ssl-FBEKYXpH"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the memory management handling for the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart.\r\n\r\nThis vulnerability is due to a logic error in memory management when a device is performing Snort 3 SSL packet inspection. An attacker could exploit this vulnerability by sending crafted SSL packets through an established connection to be parsed by the Snort 3 Detection Engine. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine unexpectedly restarts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-788", "description": "Access of Memory Location After End of Buffer"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-04T17:46:57.096Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20052", "state": "PUBLISHED", "dateUpdated": "2026-03-04T20:46:43.211Z", "dateReserved": "2025-10-08T11:59:15.355Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-03-04T17:46:57.096Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Cisco Secure Firewall Threat Defense (FTD) Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.4.1.1"}, {"status": "affected", "version": "7.6.0"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.4.2.1"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "5BC88149-095A-41DE-AA27-1CFD21125EF4", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "BA983223-35AE-4D2F-B2F5-BA0614908C3B", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "17A31A33-2E84-4C79-86BD-1E9FF4C1DD09", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "B58DC884-9430-49D4-AA8B-7FEB7505B7A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "5EC075D4-0033-46ED-9E55-576997424382", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "E91D9CAD-174A-4AAE-AB14-BD3110F9CFA1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the memory management handling for the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart.\r\n\r\nThis vulnerability is due to a logic error in memory management when a device is performing Snort 3 SSL packet inspection. An attacker could exploit this vulnerability by sending crafted SSL packets through an established connection to be parsed by the Snort 3 Detection Engine. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine unexpectedly restarts."}, {"lang": "es", "value": "Una vulnerabilidad en el manejo de la gesti\u00f3n de memoria para el Motor de Detecci\u00f3n Snort 3 del software Cisco Secure Cortafuegos Defensa contra Amenazas (FTD) podr\u00eda permitir a un atacante remoto no autenticado causar que el Motor de Detecci\u00f3n Snort 3 se reinicie.\n\nEsta vulnerabilidad se debe a un error de l\u00f3gica en la gesti\u00f3n de memoria cuando un dispositivo est\u00e1 realizando inspecci\u00f3n de paquetes SSL de Snort 3. Un atacante podr\u00eda explotar esta vulnerabilidad enviando paquetes SSL manipulados a trav\u00e9s de una conexi\u00f3n establecida para ser analizados por el Motor de Detecci\u00f3n Snort 3. Un exploit exitoso podr\u00eda permitir al atacante causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS) cuando el Motor de Detecci\u00f3n Snort 3 se reinicia inesperadamente."}], "id": "CVE-2026-20052", "lastModified": "2026-08-20T16:39:17.133", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20052", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T20:46:35.971901Z", "version": "2.0.3"}}]}, "published": "2026-03-04T18:16:19.420", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3ssl-FBEKYXpH"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-788"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.2.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Cisco Secure Firewall Threat Defense (FTD) Software", "source": "cna", "vendor": "Cisco"}, "product": "secure_firewall_threat_defense", "vendor": "cisco"}], "analysis": {"en": {"generated_at": "2026-04-16T13:20:59.180477+00:00", "value": {"mitigation_remediation": ["Upgrade Cisco Secure Firewall Threat Defense software to the latest version that fixes the Snort 3 SSL packet inspection memory management issue.", "If an immediate software update is unavailable, consider disabling Snort 3 SSL packet inspection on affected firewalls until a patch is applied to mitigate the restart risk.", "Monitor firewall logs for unexpected restarts of the Snort 3 Detection Engine and inspect for anomalous traffic patterns that may indicate attempted exploitation."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Cisco Secure Firewall Threat Defense (FTD) software that includes the Snort 3 Detection Engine with SSL packet inspection enabled. Specific version information is not provided, so all deployments of the affected software are potentially vulnerable until a patch is applied.", "description_and_impact": "A logic error in memory management of the Snort 3 Detection Engine in Cisco Secure Firewall Threat Defense software could allow an unauthenticated remote attacker to cause the engine to restart. The flaw arises when the device performs Snort 3 SSL packet inspection and processes crafted SSL packets sent through an established connection. Exploitation results in a denial of service as the Snort 3 Detection Engine unexpectedly restarts, interrupting the firewall\u2019s packet inspection capabilities. This issue corresponds to CWE\u2011788, insecure memory management.", "risk_and_exploitability": "The CVSS score of 5.8 indicates moderate risk, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog. The attack requires remote, unauthenticated access to send crafted SSL packets to the firewall; no privilege escalation or local access is needed. Once exploited, the Snort 3 engine restarts, causing a service interruption that can degrade firewall performance for all traffic passing through the device."}}}}, "created": "2026-03-05T09:06:19.071523+00:00", "updated": "2026-04-16T13:30:16.043147+00:00", "vendors": ["cisco", "cisco$PRODUCT$secure_firewall_threat_defense"]}