SHIFTWIRE
Log inGet Early Access
BACK TO THE WIRE
SW-000350CISCO · MULTIPLE CISCO PRODUCTS (SNORT 3 DETECTION ENGINE) · SNORT 3 GRE TUNNEL DECAPSULATIONMEDIUMACTION REQUIRED

Cisco discloses Snort 3 GRE decapsulation DoS flaw (CVE-2026-20221) across multiple products

Cisco published an advisory for CVE-2026-20221, a denial-of-service vulnerability in the GRE tunnel decapsulation feature of the Snort 3 Detection Engine, caused by improper handling of nested GRE traffic. An unauthenticated remote attacker could send crafted GRE payloads to trigger an unexpected restart of the Snort 3 engine, causing a bypass or DoS depending on configuration. Cisco rates this Medium severity (CVSS 5.8) and has released fixed software; no workarounds exist. Affected surfaces include Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software when Snort 3 is active with certain intrusion policies, Unified Threat Defense (UTD) on Cisco IOS XE Software and IOS XE SD-WAN Software, Cisco Meraki MX Security Appliances, Cisco Cyber Vision, and Cisco Cloud-delivered Firewall (CDFW) and Secure Access (CSA). Cisco Secure Firewall ASA, Secure FMC, and Open Source Snort 2 are confirmed not vulnerable.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORY

PUBLISHED OCT 23, 2026 19:47 UTC

WHAT CHANGED

Cisco disclosed CVE-2026-20221, a vulnerability in Snort 3's GRE tunnel decapsulation logic that mishandles nested GRE traffic, allowing a remote unauthenticated attacker to crash the Snort 3 Detection Engine via a crafted GRE payload, causing an automatic restart with resulting bypass or DoS depending on device configuration. Fixes are available: Open Source Snort 3 3.12.4.0; Cisco IOS XE Software releases 17.12.8, 17.15.6, 17.18.5, 26.1.2, 26.2.1 for UTD; Cisco Cyber Vision 5.5.0 and 5.6.0 (5.4 and earlier must migrate to a fixed release); Cisco Meraki MX appliances and Cisco CDFW/CSA cloud instances have already been automatically updated as of October 21, 2026. Secure FTD fixed release details are referenced via the Cisco Software Checker tool rather than listed directly in the advisory text. No workarounds exist, and Cisco PSIRT is not aware of any public exploitation.

WHY IT MATTERS

Administrators running Snort 3 on affected Cisco platforms face a remotely triggerable denial-of-service or detection-bypass condition that requires no authentication, which could degrade intrusion detection/prevention coverage or disrupt traffic inspection during exploitation. Because the vulnerability spans multiple product lines with different fix mechanisms (manual firmware upgrades for IOS XE and Cyber Vision, automatic updates for Meraki and CDFW/CSA, and version-dependent exposure for FTD based on Snort version and intrusion policy), admins must verify which Snort version and configuration is active on each affected device and apply the correct fixed release where automatic updates do not apply.

WHO IS AFFECTED

ROLES
Network security administratorsFirewall administrators
PRODUCTS
Open Source Snort 3Cisco Secure Firewall Threat Defense (FTD) SoftwareUnified Threat Defense (UTD) on Cisco IOS XE SoftwareCisco Meraki MX Security AppliancesCisco Cyber VisionCisco Cloud-delivered Firewall (CDFW)Cisco Secure Access (CSA)
FEATURES
Snort 3 Detection Engine GRE tunnel decapsulation
CONFIGURATIONS
Snort 3 enabled with Connectivity Over Security, Balanced Security and Connectivity, Security Over Connectivity, or Maximum Detection intrusion policyCustom Snort 3 policy with arbitrary UDP rule enabledUTD Snort IPS Engine enabled on Cisco IOS XE Software or IOS XE SD-WAN Software
EXCLUSIONS
Cisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareCisco Secure Firewall Management Center (FMC) SoftwareOpen Source Snort 2

WHAT TO DO

  1. 01
    HIGHAUTOMATABLE

    Upgrade Open Source Snort 3 installations to release 3.12.4.0 or later, the first fixed release.

  2. 02
    HIGHAUTOMATABLE

    Use the Cisco Software Checker to identify the fixed Cisco Secure FTD Software release for your current version and upgrade accordingly.

  3. 03
    MEDIUMAUTOMATABLE

    Determine whether Snort 3 (not Snort 2) is active on Cisco Secure FTD devices before assuming exposure, since only Snort 3 is affected.

  4. 04
    HIGHAUTOMATABLE

    Check whether UTD is enabled on affected IOS XE routers using 'show utd engine standard status' and, if enabled, upgrade to the first fixed release for the applicable train (17.12.8, 17.15.6, 17.18.5, 26.1.2, or 26.2.1).

  5. 05
    HIGHAUTOMATABLE

    Migrate Cisco Cyber Vision deployments running release 5.4 or earlier to a fixed release (5.5.0 or 5.6.0).

  6. 06
    LOW

    Verify that Cisco Meraki MX security appliances remain online and connected to the Meraki Dashboard to confirm automatic application of the Snort 3 fix.

TIMELINE

ANNOUNCED
OCT 21, 2026

SOURCES

  • PRIMARY SOURCECISCO

    Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability

    PUBLISHED OCT 21, 2026VIEW SOURCE

VERIFICATION

HUMAN VERIFIEDLAST VERIFIED OCT 23, 2026 19:48 UTCREVISION 4

ShiftWire summarizes and analyzes changes from the cited sources. Always review the primary source before implementing material changes.

WAS THIS USEFUL?