Description
A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user.

This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.
Published: 2026-10-21
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Arbitrary Command Execution
Action: Apply Patch
AI Analysis

Impact

The control channel socket of Cisco Open Source Snort 3 lacks authentication for local users, allowing an attacker with low local privileges to connect and issue commands that execute as the Snort process user. This flaw enables the attacker to run arbitrary commands and read or write the Snort 3 process memory, effectively taking control of the service.

Affected Systems

Cisco Open Source Snort 3 is affected. The advisory does not list specific versions, so all currently supported releases are considered vulnerable unless a patch has been applied.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. EPSS data is not available, but the flaw is locally exploitable and would only require a user with access to the host to establish a socket connection. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known commercial exploits yet. However, local attackers in trusted or compromised environments retain a significant risk of abuse.

Generated by OpenCVE AI on October 22, 2026 at 04:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest version of Cisco Open Source Snort 3 that contains the fix for the control channel socket authentication issue.
  • Restrict local access to the control channel socket by setting restrictive file system permissions, using a dedicated user, or limiting connections through OS policies or firewall rules.
  • If the control channel is not required for your deployment, disable or remove it to eliminate the attack surface.
  • Maintain up‑to‑date system patches and monitor for any re‑leases that address this weakness.

Generated by OpenCVE AI on October 22, 2026 at 04:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Cisco
Cisco cisco Open Source Snort3
Vendors & Products Cisco
Cisco cisco Open Source Snort3

Thu, 22 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description A vulnerability in the control channel socket implementation of&nbsp;Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.
Title Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Cisco Cisco Open Source Snort3
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-10-22T13:37:52.029Z

Reserved: 2026-08-19T12:02:03.643Z

Link: CVE-2026-76524

cve-icon Vulnrichment

Updated: 2026-10-22T13:34:32.381Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T17:19:09.610

Modified: 2026-10-22T14:17:49.670

Link: CVE-2026-76524

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T14:57:17Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function