Multiple Snort 2 and Snort 3 Versions to Reach End of Life in December 2025

Critical Vulnerabilities in Cisco Snort 3 DCE/RPC Processing

Two critical vulnerabilities have been discovered in Cisco's Snort 3 detection engine, affecting a wide range of Cisco products including Cisco Secure Firewall Threat Defense, open-source Snort 3, Cisco IOS XE with Unified Threat Defense, and Cisco Meraki appliances. These flaws, identified as CVE-2026-20026 and CVE-2026-20027, stem from improper handling of Distributed Computing Environment/Remote Procedure Call (DCE/RPC) requests, allowing unauthenticated remote attackers to either disrupt packet inspection services or extract sensitive information from affected systems. The vulnerabilities are particularly concerning for organizations running Snort 3 on Cisco Secure FTD releases 7.0.0 and later, where Snort 3 is enabled by default, significantly expanding the attack surface. The first vulnerability (CVE-2026-20026) is a use-after-free condition that can trigger denial of service by causing unexpected engine restarts, while the second (CVE-2026-20027) is an out-of-bounds read that could lead to sensitive data leakage. Cisco has released software updates to address these issues, but no workarounds are available. The vulnerabilities can be exploited by sending specially crafted DCE/RPC requests through monitored network connections, and no authentication is required for exploitation, making internet-facing systems especially at risk. Organizations are urged to apply the available patches promptly to mitigate potential threats.