On 21 October 2026, Cisco published a security hardening release for Snort 3, the inspection engine inside a lot of their firewalls. They rated it Critical with a CVSS score of 9.0.
If you run Secure Firewall Threat Defense (FTD), this one is on your plate. If you use Meraki MX or Cisco's cloud firewall, you can relax a bit. More on that below.
What's in it
Cisco grouped many fixes into four CVEs, each scored by the worst bug inside it:
- CVE-2026-20236 (9.0): incorrect calculation
- CVE-2026-20043 (9.0): out-of-bounds write
- CVE-2026-20291 (7.8): improper privilege management
- CVE-2026-20356 (7.5): uncontrolled resource consumption
Snort inspects traffic passing through the firewall, so bugs in it can often be triggered by crafted traffic, not just by an admin. That's why these get high scores.
The good news: Cisco says they were found during internal testing (including with frontier AI models) and are not known to be exploited. There are no workarounds, though, so upgrading is the only fix.
Who needs to do what
| Product | Action |
|---|---|
| Secure Firewall Threat Defense (FTD) | Upgrade: 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0 depending on your train |
| UTD on IOS XE | Upgrade IOS XE: 17.12.8, 17.15.6, 17.18.5, 26.1.2 or 26.2.1 |
| Cyber Vision | Move to 5.6.0 or later |
| Open source Snort 3 | Upgrade to 3.12.4.0 |
| Meraki MX, Cloud-delivered Firewall, Secure Access | Nothing to do. Cisco updated online devices and cloud instances automatically on 21 October. |
Snort 2 is not affected, but it's end of life, so that's not a reason to stay on it.
Quick tips for the FTD upgrade
- Check the upgrade path from your current version in the release notes before you start.
- Do HA pairs one unit at a time and confirm failover works.
- If you manage through FMC, check FMC compatibility with the target FTD version first.
My take
Vendors finding their own bugs with AI tools is a trend you'll see more of. Fortinet did the same this month. It means more fixes, more often. Having a tested, boring upgrade process matters more than ever.
Personal view only. Always check Cisco's advisory for the fixed release of your exact platform.
Comments
No comments yet. Share your own debugging war story.