Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 1 vendor · 2 advisories

CVE-2026-20221

Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability

CVE-2026-20221: Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability. Not in the CISA KEV catalog.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-20221 at a glance

CISA KEV
Not listed (catalog checked )
Highest advisory severity
Medium
CVSS base score
5.8 (Cisco)
Fixed releases
  • Cisco: 17.12.8, 17.15.6, 17.18.5, 26.1.2, 26.2.1, 5.5.0 and 1 more in the advisory
Vendor advisories
2 from Cisco
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-20221; bulletin-wide values are not repeated here.

Is CVE-2026-20221 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-20221 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-20221?

Upgrade to a fixed release named by the vendor:

  • Cisco: 17.12.8, 17.15.6, 17.18.5, 26.1.2, 26.2.1, 5.5.0
  • Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory. (Cisco)
  • Release 17.12: upgrade to 17.12.8. (Cisco)

Vendor advisory comparison

Cisco

2 advisories
  • Advisory severityMedium5.8

    Medium [CVE-2026-20221] Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability

    cisco-sa-snort3-gre-JNpMHrTvSource published Source updated

    Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine. This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the Details section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual…

    Affected products in this advisory
    • Secure Firewall Threat Defense (FTD) Software
    • Firepower 2100 Series
    • Firepower 1000 Series
    • ASA 5500-X Series Firewalls

    4 more entries in the full advisory.

    Source-reported affected versions
    • Scope: For information about which products are affected by this vulnerability at the time of publication, see the following sections. Open Source Snort 3
    • Release 17.12 (first fixed: 17.12.8)
    • Release 17.15 (first fixed: 17.15.6)
    • Release 17.18 (first fixed: 17.18.5)

    5 more entries in the full advisory.

    Source-reported fixed versions
    • 17.12.8
    • 17.15.6
    • 17.18.5
    • 26.1.2

    3 more entries in the full advisory.

    Mitigation guidance
    • Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
    • Release 17.12: upgrade to 17.12.8.
    • Release 17.15: upgrade to 17.15.6.
    • Release 17.18: upgrade to 17.18.5.

    5 more entries in the full advisory.

    Workarounds
    • There are no workarounds that address this vulnerability.
    Full advisory and evidenceOpen source bulletin
  • Advisory severityUnrated

    Advisory [CVE-2026-20011 +12] Cisco Advance Notification for Publication of October 21, 2026, Security Advisories

    cisco-sa-notice-QGwHnJ6kSource published Source updated

    This bulletin covers 13 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    On October 21, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories. To remediate the vulnerabilities that were disclosed on October 21, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery. Snort 3 Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Critical 9.0 High 7.8 Medium 5.8 5.3 Cisco Expressway and Unified Communications Products

    Affected products in this advisory
    No product details extracted. Check the source bulletin.
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • To remediate the vulnerabilities that were disclosed on October 21, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories.
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Monitor future Cisco CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features