High-severity RCE in Snort 3, a widely deployed IDS/IPS engine and embedded in Cisco security products; can compromise network security appliances across organizations.
CVE-2026-20043
Out-of-bounds write in Snort 3 enabling remote code execution in IDS/IPS
Is CVE-2026-20043 being exploited?
Not confirmed. CVE-2026-20043 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.36% probability of exploitation in the next 30 days.
How severe is CVE-2026-20043?
CVE-2026-20043 is rated Critical with a CVSS score of 9.0. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-20043?
Yes. A fix has been recorded for CVE-2026-20043. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-20043 affect?
CVE-2026-20043 affects Open Source Snort 3, Cisco Snort 3 hardening releases, Cisco products embedding Snort 3 (IDS/IPS). Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-20043?
Apply vendor Snort 3/Cisco updates immediately; isolate or restrict access to affected sensors until patched.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Remote code execution via out-of-bounds writes in Snort 3; attacker can run arbitrary code on packet-inspecting systems and compromise IDS/IPS devices.
Immediate action required
- affected3.0.0
- affected3.0.2
- affected3.0.3
- affected3.0.1
- affected3.1.0
- affected3.0.4
- affected3.1.1
- affected3.1.2
- affected3.2.0
- affected3.0.5
- affected3.2.1
- affected3.0.6
- affected3.2.2
- affected3.2.3
- affected3.2.4
- affected4.0.0
- affected4.0.1
- affected4.0.2
- affected4.0.3
- affected4.1.0
- affected4.1.1
- affected4.1.2
- affected4.1.3
- affected4.1.4
- affected4.2.0
- affected4.2.1
- affected4.1.5
- affected4.2.2
- affected4.2.X
- affected4.2.3
- affected4.2.4
- affected4.2.6
- affected4.1.6
- affected4.3.0
- affected4.3.1
- affected4.3.2
- affected4.3.3
- affected4.4.0
- affected4.4.1
- affected4.4.2
- affected4.4.3
- affected4.1.7
- affected5.0.0
- affected5.0.1
- affected5.0.2
- affected5.1.0
- affected5.1.1
- affected5.1.2
- affected5.1.3
- affected5.2.0
- affected5.2.1
- affected5.3.0
- affected5.3.1
- affected5.3.2
- affected5.3.3
- affected5.5.1
- affected5.6.1
- affected5.4.0
- affected5.4.1
- affected5.4.2
- affected5.7.0
- affected5.8.1
- affected5.7.1
- affected5.8.0
- affected5.5.2
- affected3.12.2.0
- affected3.1.2.0
- affected3.1.3.0
- affected3.1.4.0
- affected3.1.5.0
- affected3.1.6.0
- affected3.1.7.0
- affected3.1.8.0
- affected3.1.9.0
- affected3.1.10.0
- affected3.1.12.0
- affected3.1.13.0
- affected3.1.14.0
- affected3.1.15.0
- affected3.1.16.0
- affected3.1.17.0
- affected3.1.18.0
- affected3.1.19.0
- affected3.1.20.0
- affected3.1.21.0
- affected3.1.22.0
- affected3.1.23.0
- affected3.1.24.0
- affected3.1.25.0
- affected3.1.27.0
- affected3.1.28.0
- affected3.1.29.0
- affected3.1.30.0
- affected3.1.31.0
- affected3.1.32.0
- affected3.1.36.0
- affected3.1.38.0
- affected3.1.39.0
- affected3.1.40.0
- affected3.1.41.0
- affected3.1.42.0
- affected3.1.43.0
- affected3.1.45.0
- affected3.1.47.0
- affected3.1.48.0
- affected3.1.50.0
- affected3.1.51.0
- affected3.1.52.0
- affected3.1.53.0
- affected3.1.55.0
- affected3.1.56.0
- affected3.1.57.0
- affected3.1.58.0
- affected3.1.59.0
- affected3.1.60.0
- affected3.1.61.0
- affected3.1.62.0
- affected3.1.63.0
- affected3.1.64.0
- affected3.1.65.0
- affected3.1.66.0
- affected3.1.67.0
- affected3.1.69.0
- affected3.1.70.0
- affected3.1.71.0
- affected3.1.72.0
- affected3.1.73.0
- affected3.1.74.0
- affected3.1.75.0
- affected3.1.76.0
- affected3.1.77.0
- affected3.1.78.0
- affected3.1.81.0
- affected3.1.82.0
- affected3.1.83.0
- affected3.1.84.0
- affected3.2.1.0
- affected3.2.2.0
- affected3.3.0.0
- affected3.3.1.0
- affected3.3.2.0
- affected3.3.3.0
- affected3.3.4.0
- affected3.3.5.0
- affected3.3.7.0
- affected3.5.0.0
- affected3.5.1.0
- affected3.8.1.0
- affected3.6.0.0
- affected3.6.2.0
- affected3.9.3.0
- affected3.7.2.0
- affected3.7.0.0
- affected3.9.6.0
- affected3.10.0.0
- affected3.10.2.0
- affected3.7.4.0
- affected3.9.0.0
- affected3.5.2.0
- affected3.12.1.0
- affected3.6.1.0
- affected3.9.2.0
- affected3.6.3.0
- affected3.9.5.0
- affected3.7.1.0
- affected3.9.7.0
- affected3.7.3.0
- affected3.10.1.0
- affected3.9.1.0
- affected3.11.1.0
- affected7.0.0
- affected7.0.0.1
- affected7.0.1
- affected7.0.1.1
- affected7.0.2
- affected7.0.2.1
- affected7.0.3
- affected7.2.0.1
- affected7.0.4
- affected7.2.1
- affected7.0.5
- affected7.3.0
- affected7.2.2
- affected7.2.3
- affected7.3.1
- affected7.2.4
- affected7.0.6
- affected7.2.5
- affected7.2.4.1
- affected7.3.1.1
- affected7.4.0
- affected7.0.6.1
- affected7.2.5.1
- affected7.4.1
- affected7.2.6
- affected7.0.6.2
- affected7.4.1.1
- affected7.2.7
- affected7.2.5.2
- affected7.3.1.2
- affected7.2.8
- affected7.6.0
- affected7.4.2
- affected7.2.8.1
- affected7.0.6.3
- affected7.4.2.1
- affected7.2.9
- affected7.0.7
- affected7.7.0
- affected7.4.2.2
- affected7.2.10
- affected7.6.1
- affected7.4.2.3
- affected7.0.8
- affected7.6.2
- affected7.7.10
- affected7.7.11
- affected7.0.8.1
- affected7.6.2.1
- affected7.7.10.1
- affected7.4.2.4
- affected7.2.10.2
- affected7.4.3
- affected7.6.4
- affected10.0.0
- affected7.4.4
- affected7.0.9
- affected7.2.11
- affected7.4.7
- affected17.3.1a
- affected17.3.2
- affected17.4.1a
- affected17.5.1
- affected17.3.3
- affected17.5.1a
- affected17.3.4
- affected17.3.4a
- affected17.4.2
- affected17.4.1b
- affected17.6.1a
- affected17.7.1a
- affected17.6.2
- affected17.8.1a
- affected17.3.5
- affected17.6.3
- affected17.6.3a
- affected17.7.2
- affected17.9.1a
- affected17.6.4
- affected17.10.1a
- affected17.3.6
- affected17.3.7
- affected17.9.2a
- affected17.6.5
- affected17.11.1a
- affected17.9.3a
- affected17.12.1a
- affected17.9.4
- affected17.6.6
- affected17.3.8
- affected17.3.8a
- affected17.6.6a
- affected17.9.4a
- affected17.12.2
- affected17.13.1a
- affected17.9.5a
- affected17.12.3
- affected17.6.7
- affected17.14.1a
- affected17.12.4
- affected17.12.3a
- affected17.15.1a
- affected17.6.8
- affected17.9.6
- affected17.6.8a
- affected17.16.1a
- affected17.9.5e
- affected17.12.4a
- affected17.15.2c
- affected17.9.5f
- affected17.12.4b
- affected17.15.2a
- affected17.12.5
- affected17.17.1
- affected17.12.5a
- affected17.9.7a
- affected17.15.3a
- affected17.15.3
- affected17.12.5b
- affected17.12.5c
- affected17.15.4
- affected17.9.7b
- affected17.18.1
- affected17.18.1a
- affected17.12.6
- affected17.9.8
- affected17.15.4c
- affected17.12.5d
- affected17.18.2
- affected26.1.1
- affected17.15.5
- affected17.15.5a
- affected17.12.7
- affected17.12.7a
- affected17.12.7b
- affected17.9.9
- affected17.18.3a
- affected17.12.8
- affected17.15.6
- affected17.18.4
- affected26.1.2
- affected17.9.10
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.