Description
A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user.

This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.
Published: 2026-10-21
Score: 7.8 High
EPSS: n/a
KEV: No
Impact: Local Arbitrary Command Execution
Action: Apply Patch
AI Analysis

Impact

A missing authentication check in the control channel socket of Cisco Open Source Snort 3 allows a user with low local privileges to connect and send commands that are executed as the Snort process user. This flaw enables the attacker to run arbitrary code and to read or modify the Snort 3 process memory, effectively taking control of the service without needing higher privileges.

Affected Systems

Cisco Open Source Snort 3 is affected. The advisory does not list specific versions, so all currently supported releases are considered vulnerable unless a patch has been applied.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. EPSS data is not available, but the flaw is locally exploitable and would only require a user with access to the host to establish a socket connection. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known commercial exploits yet. However, local attackers in trusted or compromised environments retain a significant risk of abuse.

Generated by OpenCVE AI on October 21, 2026 at 21:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest version of Cisco Open Source Snort 3 that contains the fix for the control channel socket authentication issue.
  • Restrict local access to the control channel socket by setting restrictive file system permissions, using a dedicated user, or limiting connections through OS policies or firewall rules.
  • If the control channel is not required for your deployment, disable or remove it to eliminate the attack surface.
  • Maintain up‑to‑date system patches and monitor for any re‑leases that address this weakness.

Generated by OpenCVE AI on October 21, 2026 at 21:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.
Title Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-10-21T16:18:12.052Z

Reserved: 2026-08-19T12:02:03.643Z

Link: CVE-2026-76524

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T17:19:09.610

Modified: 2026-10-21T18:54:37.403

Link: CVE-2026-76524

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T21:15:16Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function