CVE-2026-20054 - Vulnerability Details

CVE-2026-20054 - Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Infinite Loop Denial of Service Vulnerability

Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. 

This vulnerability is due to improper error checking when decompressing VBA data. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to enter an infinite loop, causing a DoS condition.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00094.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco Cyber Vision

unknown

Version	Status	Constraints
`3.0.0`	affected	—
`3.0.2`	affected	—
`3.0.3`	affected	—
`3.0.1`	affected	—
`3.1.0`	affected	—
`3.0.4`	affected	—
`3.1.1`	affected	—
`3.1.2`	affected	—
`3.2.0`	affected	—
`3.0.5`	affected	—
`3.2.1`	affected	—
`3.0.6`	affected	—
`3.2.2`	affected	—
`3.2.3`	affected	—
`3.2.4`	affected	—
`4.0.0`	affected	—
`4.0.1`	affected	—
`4.0.2`	affected	—
`4.0.3`	affected	—
`4.1.0`	affected	—
`4.1.1`	affected	—
`4.1.2`	affected	—
`4.1.3`	affected	—
`4.1.4`	affected	—
`4.2.0`	affected	—
`4.2.1`	affected	—
`4.1.5`	affected	—
`4.2.2`	affected	—
`4.2.X`	affected	—
`4.2.3`	affected	—
`4.2.4`	affected	—
`4.2.6`	affected	—
`4.1.6`	affected	—
`4.3.0`	affected	—
`4.3.1`	affected	—
`4.3.2`	affected	—
`4.3.3`	affected	—
`4.4.0`	affected	—
`4.4.1`	affected	—
`4.4.2`	affected	—
`4.4.3`	affected	—
`4.1.7`	affected	—
`5.0.0`	affected	—
`5.0.1`	affected	—
`5.0.2`	affected	—
`5.1.0`	affected	—
`5.1.1`	affected	—
`5.1.2`	affected	—
`5.1.3`	affected	—
`5.2.0`	affected	—
`5.2.1`	affected	—
`5.3.0`	affected	—
`5.3.1`	affected	—
`5.3.2`	affected	—

Cisco

Cisco Secure Firewall Threat Defense (FTD) Software

unknown

Version	Status	Constraints
`7.2.0`	affected	—
`7.2.0.1`	affected	—
`7.2.1`	affected	—
`7.3.0`	affected	—
`7.2.2`	affected	—
`7.2.3`	affected	—
`7.3.1`	affected	—
`7.2.4`	affected	—
`7.2.5`	affected	—
`7.2.4.1`	affected	—
`7.3.1.1`	affected	—
`7.4.0`	affected	—
`7.2.5.1`	affected	—
`7.4.1`	affected	—
`7.2.6`	affected	—
`7.4.1.1`	affected	—
`7.2.7`	affected	—
`7.2.5.2`	affected	—
`7.3.1.2`	affected	—
`7.2.8`	affected	—
`7.6.0`	affected	—
`7.4.2`	affected	—
`7.2.8.1`	affected	—
`7.4.2.1`	affected	—
`7.2.9`	affected	—
`7.7.0`	affected	—
`7.4.2.2`	affected	—
`7.2.10`	affected	—
`7.6.1`	affected	—
`7.4.2.3`	affected	—
`7.6.2`	affected	—
`7.7.10`	affected	—
`7.6.2.1`	affected	—
`7.7.10.1`	affected	—
`7.4.2.4`	affected	—
`7.2.10.2`	affected	—
`7.4.3`	affected	—

Cisco

Cisco UTD SNORT IPS Engine Software

unknown

Version	Status	Constraints
`3.17.1S`	affected	—
`16.12.3`	affected	—
`Fuji-16.9.5`	affected	—
`16.12.4`	affected	—
`17.3.1a`	affected	—
`16.6.6`	affected	—
`16.12.2`	affected	—
`Fuji-16.9.6`	affected	—
`3.17.0S`	affected	—
`Fuji-16.9.3`	affected	—
`Denali-16.3.7`	affected	—
`Fuji-16.9.2`	affected	—
`Fuji-16.9.4`	affected	—
`Everest-16.6.4`	affected	—
`Everest-16.6.3`	affected	—
`16.6.5`	affected	—
`Denali-16.3.5`	affected	—
`17.2.1r`	affected	—
`17.1.1`	affected	—
`Everest-16.6.2`	affected	—
`16.6.7a`	affected	—
`Denali-16.3.4`	affected	—
`16.6.1`	affected	—
`Denali-16.3.9`	affected	—
`Denali-16.3.3`	affected	—
`16.12.1a`	affected	—
`17.3.2`	affected	—
`17.4.1a`	affected	—
`16.12.5`	affected	—
`17.5.1`	affected	—
`Fuji-16.9.7`	affected	—
`16.6.9`	affected	—
`17.3.3`	affected	—
`17.5.1a`	affected	—
`17.3.4`	affected	—
`17.3.4a`	affected	—
`17.4.2`	affected	—
`17.4.1b`	affected	—
`17.6.1a`	affected	—
`16.6.10`	affected	—
`17.7.1a`	affected	—
`16.12.6`	affected	—
`Fuji-16.9.8`	affected	—
`17.6.2`	affected	—
`17.8.1a`	affected	—
`16.12.7`	affected	—
`17.3.5`	affected	—
`17.6.3`	affected	—
`17.6.3a`	affected	—
`17.7.2`	affected	—
`17.9.1a`	affected	—
`17.6.4`	affected	—
`17.10.1a`	affected	—
`17.3.6`	affected	—
`16.12.8`	affected	—
`17.3.7`	affected	—
`17.9.2a`	affected	—
`17.6.5`	affected	—
`17.11.1a`	affected	—
`17.9.3a`	affected	—
`17.12.1a`	affected	—
`17.9.4`	affected	—
`17.6.6`	affected	—
`17.3.8`	affected	—
`17.3.8a`	affected	—
`17.6.6a`	affected	—
`17.9.4a`	affected	—
`17.12.2`	affected	—
`17.13.1a`	affected	—
`17.9.5a`	affected	—
`17.12.3`	affected	—
`17.6.7`	affected	—
`17.14.1a`	affected	—
`17.12.4`	affected	—
`17.12.3a`	affected	—
`17.15.1a`	affected	—
`17.6.8`	affected	—
`17.9.6`	affected	—
`17.6.8a`	affected	—
`17.16.1a`	affected	—
`17.9.5e`	affected	—
`17.12.4a`	affected	—
`17.15.2c`	affected	—
`17.9.5f`	affected	—
`17.12.4b`	affected	—
`17.15.2a`	affected	—
`17.12.5`	affected	—
`17.17.1`	affected	—
`17.12.5a`	affected	—
`17.9.7a`	affected	—
`17.15.3a`	affected	—
`17.15.3`	affected	—
`17.12.5b`	affected	—
`17.12.5c`	affected	—
`17.15.4`	affected	—
`17.9.7b`	affected	—
`17.18.1`	affected	—
`17.18.1a`	affected	—
`17.12.6`	affected	—
`17.9.8`	affected	—
`17.15.4c`	affected	—
`17.12.5d`	affected	—
`17.18.2`	affected	—

No data.

Vendor Product Confidence Versions

Cisco

Cisco Utd Snort Ips Engine Software

100%

Version	Status	Scheme	Platform
`3.17.1S`	affected	generic	—
`16.12.3`	affected	semver	—
`Fuji-16.9.5`	affected	generic	—
`16.12.4`	affected	semver	—
`17.3.1a`	affected	generic	—
`16.6.6`	affected	semver	—
`16.12.2`	affected	semver	—
`Fuji-16.9.6`	affected	generic	—
`3.17.0S`	affected	generic	—
`Fuji-16.9.3`	affected	generic	—
`Denali-16.3.7`	affected	generic	—
`Fuji-16.9.2`	affected	generic	—
`Fuji-16.9.4`	affected	generic	—
`Everest-16.6.4`	affected	generic	—
`Everest-16.6.3`	affected	generic	—
`16.6.5`	affected	semver	—
`Denali-16.3.5`	affected	generic	—
`17.2.1r`	affected	generic	—
`17.1.1`	affected	semver	—
`Everest-16.6.2`	affected	generic	—
`16.6.7a`	affected	generic	—
`Denali-16.3.4`	affected	generic	—
`16.6.1`	affected	semver	—
`Denali-16.3.9`	affected	generic	—
`Denali-16.3.3`	affected	generic	—
`16.12.1a`	affected	semver	—
`17.3.2`	affected	semver	—
`17.4.1a`	affected	generic	—
`16.12.5`	affected	semver	—
`17.5.1`	affected	semver	—
`Fuji-16.9.7`	affected	generic	—
`16.6.9`	affected	semver	—
`17.3.3`	affected	semver	—
`17.5.1a`	affected	generic	—
`17.3.4`	affected	semver	—
`17.3.4a`	affected	generic	—
`17.4.2`	affected	semver	—
`17.4.1b`	affected	generic	—
`17.6.1a`	affected	generic	—
`16.6.10`	affected	semver	—
`17.7.1a`	affected	generic	—
`16.12.6`	affected	semver	—
`Fuji-16.9.8`	affected	generic	—
`17.6.2`	affected	semver	—
`17.8.1a`	affected	generic	—
`16.12.7`	affected	semver	—
`17.3.5`	affected	semver	—
`17.6.3`	affected	semver	—
`17.6.3a`	affected	generic	—
`17.7.2`	affected	semver	—
`17.9.1a`	affected	generic	—
`17.6.4`	affected	semver	—
`17.10.1a`	affected	semver	—
`17.3.6`	affected	semver	—
`16.12.8`	affected	semver	—
`17.3.7`	affected	semver	—
`17.9.2a`	affected	generic	—
`17.6.5`	affected	semver	—
`17.11.1a`	affected	generic	—
`17.9.3a`	affected	generic	—
`17.12.1a`	affected	generic	—
`17.9.4`	affected	generic	—
`17.6.6`	affected	semver	—
`17.3.8`	affected	semver	—
`17.3.8a`	affected	generic	—
`17.6.6a`	affected	generic	—
`17.9.4a`	affected	generic	—
`17.12.2`	affected	generic	—
`17.13.1a`	affected	generic	—
`17.9.5a`	affected	generic	—
`17.12.3`	affected	semver	—
`17.6.7`	affected	generic	—
`17.14.1a`	affected	generic	—
`17.12.4`	affected	semver	—
`17.12.3a`	affected	generic	—
`17.15.1a`	affected	semver	—
`17.6.8`	affected	generic	—
`17.9.6`	affected	semver	—
`17.10.1a`	affected	semver	—
`17.3.6`	affected	semver	—
`17.12.2`	affected	generic	—
`17.13.1a`	affected	generic	—
`17.9.5a`	affected	generic	—
`17.12.3`	affected	semver	—
`17.6.7`	affected	generic	—
`17.14.1a`	affected	generic	—
`17.12.4`	affected	semver	—
`17.12.3a`	affected	generic	—
`17.15.1a`	affected	semver	—
`17.6.8`	affected	generic	—
`17.9.6`	affected	semver	—
`17.10.1a`	affected	semver	—
`17.3.6`	affected	semver	—
`17.12.2`	affected	generic	—
`17.13.1a`	affected	generic	—
`17.9.5a`	affected	generic	—
`17.12.3`	affected	semver	—
`17.6.7`	affected	generic	—
`17.14.1a`	affected	generic	—
`17.12.4`	affected	semver	—
`17.12.3a`	affected	generic	—
`17.15.1a`	affected	semver	—

Cisco

Cyber Vision

86%

Version	Status	Scheme	Platform
`3.0.0`	affected	semver	—
`3.0.2`	affected	semver	—
`3.0.3`	affected	semver	—
`3.0.1`	affected	semver	—
`3.1.0`	affected	semver	—
`3.0.4`	affected	semver	—
`3.1.1`	affected	semver	—
`3.1.2`	affected	semver	—
`3.2.0`	affected	semver	—
`3.0.5`	affected	semver	—
`3.2.1`	affected	semver	—
`3.0.6`	affected	semver	—
`3.2.2`	affected	semver	—
`3.2.3`	affected	semver	—
`3.2.4`	affected	semver	—
`[0,*]`	affected	generic	—
`4.0.0`	affected	semver	—
`4.0.1`	affected	semver	—
`4.0.2`	affected	semver	—
`4.0.3`	affected	semver	—
`4.1.0`	affected	semver	—
`4.1.1`	affected	semver	—
`4.1.2`	affected	semver	—
`4.1.3`	affected	semver	—
`4.1.4`	affected	semver	—
`4.2.0`	affected	semver	—
`4.2.1`	affected	semver	—
`4.1.5`	affected	semver	—
`4.2.2`	affected	semver	—
`4.2.X`	affected	generic	—
`4.2.3`	affected	semver	—
`4.2.4`	affected	semver	—
`4.2.6`	affected	semver	—
`4.1.6`	affected	semver	—
`4.3.0`	affected	semver	—
`4.3.1`	affected	semver	—
`4.3.2`	affected	semver	—
`4.3.3`	affected	semver	—
`4.4.0`	affected	semver	—
`4.4.1`	affected	semver	—
`4.4.2`	affected	semver	—
`4.4.3`	affected	semver	—
`4.1.7`	affected	semver	—
`5.0.0`	affected	semver	—
`5.0.1`	affected	semver	—
`5.0.2`	affected	semver	—
`5.1.0`	affected	semver	—
`5.1.1`	affected	semver	—
`5.1.2`	affected	semver	—
`5.1.3`	affected	semver	—
`5.2.0`	affected	semver	—
`5.2.1`	affected	semver	—
`5.3.0`	affected	semver	—
`5.3.1`	affected	semver	—
`5.3.2`	affected	semver	—

Cisco

Secure Firewall Threat Defense

100%

Version	Status	Scheme	Platform
`7.2.0`	affected	semver	—
`7.2.0.1`	affected	semver	—
`7.2.1`	affected	semver	—
`7.3.0`	affected	semver	—
`7.2.2`	affected	semver	—
`7.2.3`	affected	semver	—
`7.3.1`	affected	semver	—
`7.2.4`	affected	semver	—
`7.2.5`	affected	semver	—
`7.2.4.1`	affected	semver	—
`7.3.1.1`	affected	semver	—
`7.4.0`	affected	semver	—
`7.2.5.1`	affected	semver	—
`7.4.1`	affected	semver	—
`7.2.6`	affected	semver	—
`7.4.1.1`	affected	semver	—
`7.2.7`	affected	semver	—
`7.2.5.2`	affected	semver	—
`7.3.1.2`	affected	semver	—
`7.2.8`	affected	semver	—
`7.6.0`	affected	semver	—
`7.4.2`	affected	semver	—
`7.2.8.1`	affected	semver	—
`7.4.2.1`	affected	semver	—
`7.2.9`	affected	semver	—
`7.7.0`	affected	semver	—
`7.4.2.2`	affected	semver	—
`7.2.10`	affected	semver	—
`7.6.1`	affected	semver	—
`7.4.2.3`	affected	semver	—
`7.6.2`	affected	semver	—
`7.7.10`	affected	semver	—
`7.6.2.1`	affected	semver	—
`7.7.10.1`	affected	semver	—
`7.4.2.4`	affected	semver	—
`7.2.10.2`	affected	semver	—
`7.4.3`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Project Subscriptions

Vendors	Products
Cisco Subscribe	Cisco Utd Snort Ips Engine Software Subscribe Cyber Vision Subscribe Secure Firewall Threat Defense Subscribe

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed

History

Thu, 05 Mar 2026 09:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco cisco Utd Snort Ips Engine Software Cisco cyber Vision Cisco secure Firewall Threat Defense
Vendors & Products		Cisco Cisco cisco Utd Snort Ips Engine Software Cisco cyber Vision Cisco secure Firewall Threat Defense

Wed, 04 Mar 2026 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 04 Mar 2026 18:00:00 +0000

Type	Values Removed	Values Added
Description		Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.  This vulnerability is due to improper error checking when decompressing VBA data. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to enter an infinite loop, causing a DoS condition.
Title		Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Infinite Loop Denial of Service Vulnerability
Weaknesses		CWE-835
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed
Metrics		cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2026-03-04T17:47:05.854Z

Updated: 2026-03-04T21:30:54.724Z

Reserved: 2025-10-08T11:59:15.355Z

Link: CVE-2026-20054

Vulnrichment

Updated: 2026-03-04T21:30:47.097Z

NVD

Status : Received

Published: 2026-03-04T18:16:19.920

Modified: 2026-03-04T18:16:19.920

Link: CVE-2026-20054

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-03-05T09:06:18Z

Weaknesses

CWE-835

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Project Subscriptions

Projects

JSON object

JSON object

JSON object

JSON object

JSON object