How severe is CVE-2026-20053?

CVE-2026-20053 has a CVSS 3.x base score of 5.8, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2026-20053 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-20053?

CVE-2026-20053 primarily affects Cisco Snort. In total, 120 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-20053?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-20053 have an EU (EUVD) identifier?

Yes. CVE-2026-20053 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-9459.

When was CVE-2026-20053 published?

CVE-2026-20053 was published on 2026-03-04 and last updated on 2026-08-20.

CVE-2026-20053

CVE-2026-20053 is a medium-severity vulnerability in Cisco Snort with a CVSS 3.x base score of 5.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-122.

Key facts

Severity: Medium (CVSS 3.x base score 5.8)
EPSS exploit prediction: 0% (35th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-9459
Weakness: CWE-122
Affected product: Cisco Snort
Published: 2026-03-04
Last modified: 2026-08-20

Description

Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. This vulnerability is due to improper range checking when decompressing VBA data, which is user controlled. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause an overflow of heap data, which could cause a DoS condition.

Frequently asked questions

What is CVE-2026-20053?: Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. This vulnerability is due to improper range checking when decompressing VBA data, which is user controlled. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause an overflow of heap data, which could cause a DoS condition.
How severe is CVE-2026-20053?: CVE-2026-20053 has a CVSS 3.x base score of 5.8, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2026-20053 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-20053?: CVE-2026-20053 primarily affects Cisco Snort. In total, 120 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-20053?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-20053 have an EU (EUVD) identifier?: Yes. CVE-2026-20053 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-9459.
When was CVE-2026-20053 published?: CVE-2026-20053 was published on 2026-03-04 and last updated on 2026-08-20.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed

Affected products (120)

cpe:2.3:a:cisco:snort:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.0.2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.0.3:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.0.4:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.0.5:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.0.6:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.2.3:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:3.2.4:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.0.3:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.1.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.1.2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.1.3:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.1.4:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.1.5:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.1.6:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.1.7:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.2.2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.2.3:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.2.4:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.2.6:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.3.0:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.3.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.3.2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.3.3:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.4.0:*:*:*:*:*:*:*
cpe:2.3:a:cisco:cyber_vision:4.4.1:*:*:*:*:*:*:*

More vulnerabilities in Cisco Snort

CVE-2021-40116 — High (CVSS 8.6): Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote…
CVE-2026-20068 — Medium (CVSS 5.8): Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an…
CVE-2026-20067 — Medium (CVSS 5.8): Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an…
CVE-2026-20066 — Medium (CVSS 5.8): Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an…
CVE-2026-20065 — Medium (CVSS 5.8): Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an…
CVE-2026-20058 — Medium (CVSS 5.8): Multiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated,…

All CVEs affecting Cisco Snort →

Other CWE-122 (Heap-based Buffer Overflow) vulnerabilities

CVE-2026-46752 — Critical (CVSS 10.0): Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from…
CVE-2026-24822 — Critical (CVSS 10.0): Out-of-bounds Write, Heap-based Buffer Overflow vulnerability in ttttupup wxhelper (src modules). This vulnerability is…
CVE-2025-23123 — Critical (CVSS 10.0): A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a…
CVE-2022-34819 — Critical (CVSS 10.0): A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions <…
CVE-2026-44050 — Critical (CVSS 9.9): A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote…
CVE-2026-75143 — Critical (CVSS 9.8): FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c).…

Browse all CWE-122 (Heap-based Buffer Overflow) vulnerabilities →