CVE-2026-20052 Details
Description
A vulnerability in the memory management handling for the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This vulnerability is due to a logic error in memory management when a device is performing Snort 3 SSL packet inspection. An attacker could exploit this vulnerability by sending crafted SSL packets through an established connection to be parsed by the Snort 3 Detection Engine. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine unexpectedly restarts.
A denial-of-service vulnerability has been identified in the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software. This issue allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. The vulnerability arises from a logic error in memory management during Snort 3 SSL packet inspection. An attacker could exploit this by sending crafted SSL packets through an established connection, leading to an unexpected restart of the Snort 3 Detection Engine.
Cisco has released software updates to address this vulnerability. For instructions on upgrading Cisco Secure FTD Software, refer to the Cisco Secure FTD upgrade guide. To determine the best release to upgrade to, consult the Cisco Secure Firewall Threat Defense Compatibility Guide.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3ssl-FBEKYXpH | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-788 | Access of Memory Location After End of Buffer | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cisco secure firewall threat defense | 7.4.0 7.4.1 7.4.1.1 7.4.2 7.4.2.1 7.6.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 20, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 4, 2026 | New CVE Received | [email protected] |