CVE-2026-20221
MEDIUM 5.8Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine. This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.6%chance of exploitation in 30 days · 47th percentile
Impact if exploited
5.8CVSS 3.1 · MEDIUM
- ConfidentialityNone
- IntegrityNone
- AvailabilityLow
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Affected
Vendors Cisco
Products Cisco Cyber Vision Cisco Open Source Snort3 Cisco Secure Firewall Threat Defense (Ftd) Software Cisco Umbrella Insights Virtual Appliance Cisco Utd Snort Ips Engine Software
Weakness (CWE)
- CWE-476: NULL Pointer Dereference
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
References and research data (JSON)
All CVSS metrics
- MEDIUM 5.8 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - MEDIUM 5.8 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
References
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107378 EUVD · EUVD-2026-107378
Technical & other
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gre-JNpMHrTvCVE record · cisco · Updated 2026-10-22T19:11:26.546Z
NVD · CVE-2026-20221 · Updated 2026-10-22T14:17:40.940