Medium severity · published Jan 7, 2026
CVE-2026-20027
Cisco Snort DCERPC Stub Data Out of Bounds Read
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
Multiple Cisco products are affected by a vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive information or to restart, resulting in an interruption of packet inspection. This vulnerability is due to an error in buffer handling logic when processing DCE/RPC requests, which can result in a buffer out-of-bounds read. An attacker could exploit this vulnerability by sending a large number of DCE/RPC requests through an established connection that is inspected by Snort 3. A successful exploit could allow the attacker to obtain sensitive information in the Snort 3 data stream.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Cisco Secure Firewall Threat Defense (FTD) Software · Cisco
7.0.0; 7.0.0.1; 7.0.1; 7.1.0; 7.0.1.1; 7.1.0.1; +34 more · source: vendor
CU
Cisco UTD SNORT IPS Engine Software · Cisco
3.17.1S; 16.12.3; Fuji-16.9.5; 16.12.4; 17.3.1a; 16.6.6; +34 more · source: vendor
Affected product
CS
Cisco Secure Firewall Threat Defense (FTD) Software
Cisco
More from Cisco Secure Firewall Threat Defense (FTD) Software
9.9
CVE-2025-20333
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability
8.6
CVE-2026-20349
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
8.6
CVE-2025-20362
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability
9.9
CVE-2026-20332
Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Access Control Vulnerabilities
9.9
CVE-2026-20330
Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Neutralization Vulnerabilities