CVE-2026-20221

Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities

State: Published
Severity: 5.8 Medium
Published: Oct 21, 2026
Updated: Oct 22, 2026
Reserved: Oct 8, 2025

Description

Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine.

This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required.

Scores

CVSS	Score	Vector	Source
3.1	5.8 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L	cisco

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
Cisco Cyber VisionCisco	3.0.0Affected 3.0.2Affected 3.0.3Affected 3.0.1Affected 3.1.0Affected 3.0.4Affected 3.1.1Affected 3.1.2Affected 3.2.0Affected 3.0.5Affected 3.2.1Affected 3.0.6Affected 3.2.2Affected 3.2.3Affected 3.2.4Affected 4.0.0Affected 4.0.1Affected 4.0.2Affected 4.0.3Affected 4.1.0Affected 4.1.1Affected 4.1.2Affected 4.1.3Affected 4.1.4Affected 4.2.0Affected and 36 more versions
Cisco Open Source Snort3Cisco	3.12.2.0Affected 3.1.2.0Affected 3.1.3.0Affected 3.1.4.0Affected 3.1.5.0Affected 3.1.6.0Affected 3.1.7.0Affected 3.1.8.0Affected 3.1.9.0Affected 3.1.10.0Affected 3.1.12.0Affected 3.1.13.0Affected 3.1.14.0Affected 3.1.15.0Affected 3.1.16.0Affected 3.1.17.0Affected 3.1.18.0Affected 3.1.19.0Affected 3.1.20.0Affected 3.1.21.0Affected 3.1.22.0Affected 3.1.23.0Affected 3.1.24.0Affected 3.1.25.0Affected 3.1.27.0Affected and 80 more versions
Cisco Secure Firewall Threat Defense (FTD) SoftwareCisco	7.0.0Affected 7.0.0.1Affected 7.0.1Affected 7.0.1.1Affected 7.0.2Affected 7.2.0Affected 7.0.2.1Affected 7.0.3Affected 7.2.0.1Affected 7.0.4Affected 7.2.1Affected 7.0.5Affected 7.3.0Affected 7.2.2Affected 7.2.3Affected 7.3.1Affected 7.2.4Affected 7.0.6Affected 7.2.5Affected 7.2.4.1Affected 7.3.1.1Affected 7.4.0Affected 7.0.6.1Affected 7.2.5.1Affected 7.4.1Affected and 35 more versions
Cisco Umbrella Insights Virtual ApplianceCisco	2.6.0Affected 2.5.6Affected 2.5Affected 2.4.12Affected 2.7Affected 2.6.2Affected 2.5.5Affected 2.5.4Affected 2.8Affected 2.6.1Affected 2.5.7Affected 1.5.4Affected 1.5.5Affected 1.5.6Affected 2.0.0Affected 2.0.2Affected 2.0.3Affected 2.1.0Affected 2.1.2Affected 2.1.4Affected 2.1.5Affected 2.2Affected 2.2.1Affected 2.3Affected 2.3.1Affected and 48 more versions
Cisco UTD SNORT IPS Engine SoftwareCisco	3.17.1SAffected 16.12.3Affected Fuji-16.9.5Affected 16.12.4Affected 17.3.1aAffected 16.6.6Affected 16.12.2Affected Fuji-16.9.6Affected 3.17.0SAffected Fuji-16.9.3Affected Denali-16.3.7Affected Fuji-16.9.2Affected Fuji-16.9.4Affected Everest-16.6.4Affected Everest-16.6.3Affected 16.6.5Affected Denali-16.3.5Affected 17.2.1rAffected 17.1.1Affected Everest-16.6.2Affected 16.6.7aAffected Denali-16.3.4Affected 16.6.1Affected Denali-16.3.9Affected Denali-16.3.3Affected and 91 more versions

References

cisco-sa-snort3-gre-JNpMHrTv

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.