CVE-2026-20221

MediumCVSS 5.8/10Last modified Oct 22, 2026

Description

Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine. This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Weakness enumeration

CWE-476

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
CiscoCisco Cyber Vision3.0.0; 3.0.2; 3.0.3; 3.0.1; 3.1.0; 3.0.4; 3.1.1; 3.1.2; 3.2.0; 3.0.5; 3.2.1; 3.0.6; 3.2.2; 3.2.3; 3.2.4; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.1.0
CiscoCisco Open Source Snort33.12.2.0; 3.1.2.0; 3.1.3.0; 3.1.4.0; 3.1.5.0; 3.1.6.0; 3.1.7.0; 3.1.8.0; 3.1.9.0; 3.1.10.0; 3.1.12.0; 3.1.13.0; 3.1.14.0; 3.1.15.0; 3.1.16.0; 3.1.17.0; 3.1.18.0; 3.1.19.0; 3.1.20.0; 3.1.21.0
CiscoCisco Secure Firewall Threat Defense (FTD) Software7.0.0; 7.0.0.1; 7.0.1; 7.0.1.1; 7.0.2; 7.2.0; 7.0.2.1; 7.0.3; 7.2.0.1; 7.0.4; 7.2.1; 7.0.5; 7.3.0; 7.2.2; 7.2.3; 7.3.1; 7.2.4; 7.0.6; 7.2.5; 7.2.4.1
CiscoCisco Umbrella Insights Virtual Appliance2.6.0; 2.5.6; 2.5; 2.4.12; 2.7; 2.6.2; 2.5.5; 2.5.4; 2.8; 2.6.1; 2.5.7; 1.5.4; 1.5.5; 1.5.6; 2.0.0; 2.0.2; 2.0.3; 2.1.0; 2.1.2; 2.1.4
CiscoCisco UTD SNORT IPS Engine Software3.17.1S; 16.12.3; Fuji-16.9.5; 16.12.4; 17.3.1a; 16.6.6; 16.12.2; Fuji-16.9.6; 3.17.0S; Fuji-16.9.3; Denali-16.3.7; Fuji-16.9.2; Fuji-16.9.4; Everest-16.6.4; Everest-16.6.3; 16.6.5; Denali-16.3.5; 17.2.1r; 17.1.1; Everest-16.6.2

References

Timeline

Published
Oct 21, 2026
Last modified
Oct 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-202227.4A vulnerability in the EIGRP implementation in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall ThCVE-2026-2022310.0A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attackerCVE-2026-202248.6A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to CVE-2026-20234.3The WP Plugin Info Card plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0. This iCVE-2026-202308.6A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (UnCVE-2026-202319.9As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a CVE-2026-202325.4A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an authenticated, rCVE-2026-202336.1A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a CVE-2026-202349.9As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE PassCVE-2026-202354.9A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view sensitive informatiCVE-2026-202367.5As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering teCVE-2026-202379.1As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Pass