{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20058", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.356Z", "datePublished": "2026-03-04T17:47:14.841Z", "dateUpdated": "2026-03-04T21:01:36.320Z"}, "containers": {"cna": {"title": "Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L", "baseScore": 5.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}}], "descriptions": [{"lang": "en", "value": "Multiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.\r\n\r\nThese vulnerabilities are due to improper error checking when decompressing VBA data. An attacker could exploit these vulnerabilities by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to unexpectedly restart, causing a DoS condition."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed", "name": "cisco-sa-ftd-snort3-vbavuls-96UcVVed"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-ftd-snort3-vbavuls-96UcVVed", "discovery": "INTERNAL", "defects": ["CSCwq23369"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Access of Memory Location Before Start of Buffer", "type": "cwe", "cweId": "CWE-786"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Secure Firewall Threat Defense (FTD) Software", "versions": [{"version": "7.2.0", "status": "affected"}, {"version": "7.2.0.1", "status": "affected"}, {"version": "7.2.1", "status": "affected"}, {"version": "7.3.0", "status": "affected"}, {"version": "7.2.2", "status": "affected"}, {"version": "7.2.3", "status": "affected"}, {"version": "7.3.1", "status": "affected"}, {"version": "7.2.4", "status": "affected"}, {"version": "7.2.5", "status": "affected"}, {"version": "7.2.4.1", "status": "affected"}, {"version": "7.3.1.1", "status": "affected"}, {"version": "7.4.0", "status": "affected"}, {"version": "7.2.5.1", "status": "affected"}, {"version": "7.4.1", "status": "affected"}, {"version": "7.2.6", "status": "affected"}, {"version": "7.4.1.1", "status": "affected"}, {"version": "7.2.7", "status": "affected"}, {"version": "7.2.5.2", "status": "affected"}, {"version": "7.3.1.2", "status": "affected"}, {"version": "7.2.8", "status": "affected"}, {"version": "7.6.0", "status": "affected"}, {"version": "7.4.2", "status": "affected"}, {"version": "7.2.8.1", "status": "affected"}, {"version": "7.4.2.1", "status": "affected"}, {"version": "7.2.9", "status": "affected"}, {"version": "7.7.0", "status": "affected"}, {"version": "7.4.2.2", "status": "affected"}, {"version": "7.2.10", "status": "affected"}, {"version": "7.6.1", "status": "affected"}, {"version": "7.4.2.3", "status": "affected"}, {"version": "7.6.2", "status": "affected"}, {"version": "7.7.10", "status": "affected"}, {"version": "7.6.2.1", "status": "affected"}, {"version": "7.7.10.1", "status": "affected"}, {"version": "7.4.2.4", "status": "affected"}, {"version": "7.2.10.2", "status": "affected"}, {"version": "7.4.3", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Cisco", "product": "Cisco UTD SNORT IPS Engine Software", "versions": [{"version": "17.9.3a", "status": "affected"}, {"version": "17.12.1a", "status": "affected"}, {"version": "17.12.2", "status": "affected"}, {"version": "17.13.1a", "status": "affected"}, {"version": "17.9.5a", "status": "affected"}, {"version": "17.12.3", "status": "affected"}, {"version": "17.14.1a", "status": "affected"}, {"version": "17.12.4", "status": "affected"}, {"version": "17.12.3a", "status": "affected"}, {"version": "17.15.1a", "status": "affected"}, {"version": "17.9.6", "status": "affected"}, {"version": "17.16.1a", "status": "affected"}, {"version": "17.12.4a", "status": "affected"}, {"version": "17.15.2c", "status": "affected"}, {"version": "17.12.4b", "status": "affected"}, {"version": "17.15.2a", "status": "affected"}, {"version": "17.12.5", "status": "affected"}, {"version": "17.17.1", "status": "affected"}, {"version": "17.12.5a", "status": "affected"}, {"version": "17.15.3a", "status": "affected"}, {"version": "17.15.3", "status": "affected"}, {"version": "17.12.5b", "status": "affected"}, {"version": "17.12.5c", "status": "affected"}, {"version": "17.15.4", "status": "affected"}, {"version": "17.18.1", "status": "affected"}, {"version": "17.18.1a", "status": "affected"}, {"version": "17.12.6", "status": "affected"}, {"version": "17.15.4c", "status": "affected"}, {"version": "17.12.5d", "status": "affected"}, {"version": "17.18.2", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-04T17:47:14.841Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T21:01:22.100265Z", "id": "CVE-2026-20058", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T21:01:36.320Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20058", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T21:01:22.100265Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T21:01:31.281Z"}}], "cna": {"title": "Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service Vulnerability", "source": {"defects": ["CSCwq23369"], "advisory": "cisco-sa-ftd-snort3-vbavuls-96UcVVed", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Secure Firewall Threat Defense (FTD) Software", "versions": [{"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.2.0.1"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "7.3.0"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "7.2.3"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.2.4"}, {"status": "affected", "version": "7.2.5"}, {"status": "affected", "version": "7.2.4.1"}, {"status": "affected", "version": "7.3.1.1"}, {"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.2.5.1"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.6"}, {"status": "affected", "version": "7.4.1.1"}, {"status": "affected", "version": "7.2.7"}, {"status": "affected", "version": "7.2.5.2"}, {"status": "affected", "version": "7.3.1.2"}, {"status": "affected", "version": "7.2.8"}, {"status": "affected", "version": "7.6.0"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.2.8.1"}, {"status": "affected", "version": "7.4.2.1"}, {"status": "affected", "version": "7.2.9"}, {"status": "affected", "version": "7.7.0"}, {"status": "affected", "version": "7.4.2.2"}, {"status": "affected", "version": "7.2.10"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.4.2.3"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.7.10"}, {"status": "affected", "version": "7.6.2.1"}, {"status": "affected", "version": "7.7.10.1"}, {"status": "affected", "version": "7.4.2.4"}, {"status": "affected", "version": "7.2.10.2"}, {"status": "affected", "version": "7.4.3"}], "defaultStatus": "unknown"}, {"vendor": "Cisco", "product": "Cisco UTD SNORT IPS Engine Software", "versions": [{"status": "affected", "version": "17.9.3a"}, {"status": "affected", "version": "17.12.1a"}, {"status": "affected", "version": "17.12.2"}, {"status": "affected", "version": "17.13.1a"}, {"status": "affected", "version": "17.9.5a"}, {"status": "affected", "version": "17.12.3"}, {"status": "affected", "version": "17.14.1a"}, {"status": "affected", "version": "17.12.4"}, {"status": "affected", "version": "17.12.3a"}, {"status": "affected", "version": "17.15.1a"}, {"status": "affected", "version": "17.9.6"}, {"status": "affected", "version": "17.16.1a"}, {"status": "affected", "version": "17.12.4a"}, {"status": "affected", "version": "17.15.2c"}, {"status": "affected", "version": "17.12.4b"}, {"status": "affected", "version": "17.15.2a"}, {"status": "affected", "version": "17.12.5"}, {"status": "affected", "version": "17.17.1"}, {"status": "affected", "version": "17.12.5a"}, {"status": "affected", "version": "17.15.3a"}, {"status": "affected", "version": "17.15.3"}, {"status": "affected", "version": "17.12.5b"}, {"status": "affected", "version": "17.12.5c"}, {"status": "affected", "version": "17.15.4"}, {"status": "affected", "version": "17.18.1"}, {"status": "affected", "version": "17.18.1a"}, {"status": "affected", "version": "17.12.6"}, {"status": "affected", "version": "17.15.4c"}, {"status": "affected", "version": "17.12.5d"}, {"status": "affected", "version": "17.18.2"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed", "name": "cisco-sa-ftd-snort3-vbavuls-96UcVVed"}], "descriptions": [{"lang": "en", "value": "Multiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.\r\n\r\nThese vulnerabilities are due to improper error checking when decompressing VBA data. An attacker could exploit these vulnerabilities by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to unexpectedly restart, causing a DoS condition."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-786", "description": "Access of Memory Location Before Start of Buffer"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-04T17:47:14.841Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20058", "state": "PUBLISHED", "dateUpdated": "2026-03-04T21:01:36.320Z", "dateReserved": "2025-10-08T11:59:15.356Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-03-04T17:47:14.841Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Cisco Secure Firewall Threat Defense (FTD) Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.2.0.1"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "7.3.0"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "7.2.3"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.2.4"}, {"status": "affected", "version": "7.2.5"}, {"status": "affected", "version": "7.2.4.1"}, {"status": "affected", "version": "7.3.1.1"}, {"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.2.5.1"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.6"}, {"status": "affected", "version": "7.4.1.1"}, {"status": "affected", "version": "7.2.7"}, {"status": "affected", "version": "7.2.5.2"}, {"status": "affected", "version": "7.3.1.2"}, {"status": "affected", "version": "7.2.8"}, {"status": "affected", "version": "7.6.0"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.2.8.1"}, {"status": "affected", "version": "7.4.2.1"}, {"status": "affected", "version": "7.2.9"}, {"status": "affected", "version": "7.7.0"}, {"status": "affected", "version": "7.4.2.2"}, {"status": "affected", "version": "7.2.10"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.4.2.3"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.7.10"}, {"status": "affected", "version": "7.6.2.1"}, {"status": "affected", "version": "7.7.10.1"}, {"status": "affected", "version": "7.4.2.4"}, {"status": "affected", "version": "7.2.10.2"}, {"status": "affected", "version": "7.4.3"}]}, {"defaultStatus": "unknown", "product": "Cisco UTD SNORT IPS Engine Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "17.9.3a"}, {"status": "affected", "version": "17.12.1a"}, {"status": "affected", "version": "17.12.2"}, {"status": "affected", "version": "17.13.1a"}, {"status": "affected", "version": "17.9.5a"}, {"status": "affected", "version": "17.12.3"}, {"status": "affected", "version": "17.14.1a"}, {"status": "affected", "version": "17.12.4"}, {"status": "affected", "version": "17.12.3a"}, {"status": "affected", "version": "17.15.1a"}, {"status": "affected", "version": "17.9.6"}, {"status": "affected", "version": "17.16.1a"}, {"status": "affected", "version": "17.12.4a"}, {"status": "affected", "version": "17.15.2c"}, {"status": "affected", "version": "17.12.4b"}, {"status": "affected", "version": "17.15.2a"}, {"status": "affected", "version": "17.12.5"}, {"status": "affected", "version": "17.17.1"}, {"status": "affected", "version": "17.12.5a"}, {"status": "affected", "version": "17.15.3a"}, {"status": "affected", "version": "17.15.3"}, {"status": "affected", "version": "17.12.5b"}, {"status": "affected", "version": "17.12.5c"}, {"status": "affected", "version": "17.15.4"}, {"status": "affected", "version": "17.18.1"}, {"status": "affected", "version": "17.18.1a"}, {"status": "affected", "version": "17.12.6"}, {"status": "affected", "version": "17.15.4c"}, {"status": "affected", "version": "17.12.5d"}, {"status": "affected", "version": "17.18.2"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:snort:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED74FA2A-59F1-47F1-B4DF-260E01AD4661", "versionEndExcluding": "3.9.6.0", "versionStartIncluding": "3.0.0-233", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "533D09C0-DF12-4435-A27E-9CDAC52C3A94", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "556ADDCC-D9EF-4C37-8411-3BF01BE08EC9", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "89C51A98-255F-4BA0-B02F-B3FA85400814", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "806C6261-E164-4A33-A98A-FED94A778BFC", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "E602F23C-EA2A-4133-B4C2-A44F83AB49C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "89280DB9-9DD7-4AE2-851A-E2DA0B0DDDA7", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "9721E1E2-F000-4A00-A98B-C24C204A0D37", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "4FCDE09B-F7BA-4C06-84B4-9E5C20EC8C42", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "7C46CF43-5B90-4814-A48F-2912C4DD9BFD", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "D3F5DC7F-88B3-4FD8-8AE4-8A45A60A61B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "447CE16B-6B72-42D2-9903-996A5C0BF23F", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.7:*:*:*:*:*:*:*", "matchCriteriaId": "BA53CA29-215F-4859-8324-FA917C21E9AB", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.8:*:*:*:*:*:*:*", "matchCriteriaId": "B364E2D1-9718-4C88-8C63-8FFF6FE9BB7A", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "11F6EEC6-C9C4-4DB3-9D25-3D9166298A87", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.9:*:*:*:*:*:*:*", "matchCriteriaId": "874A3601-EA89-4ED0-8049-FC5AC051DCCD", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.10:*:*:*:*:*:*:*", "matchCriteriaId": "2987A0E8-D7BE-4292-97BC-9974D6DD0AC5", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.2.10.2:*:*:*:*:*:*:*", "matchCriteriaId": "17733893-7AF9-430C-BFBF-8C7E53541712", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "1651B288-9BDA-4D99-AC21-056A623C1CE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "9FFEF4A0-03B1-4778-B322-FBD5AB3A67D2", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.3.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "77256B4B-A43D-45ED-BDE1-CE0D27C7CBCD", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.3.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "D6306481-98F7-4D23-9353-7CA873024B51", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "22D49B09-69AC-43D4-9160-8B6B9E0BED2D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "EB336E39-949B-4824-8607-5B2EC74C0B01", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.4.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "C3819B2E-86E5-40E8-A8AD-BA6313612FCA", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "317BFD0E-B289-4947-A8BE-69644D5C8A33", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.4.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "5BD5B838-A6C8-4996-9C10-BC24770825C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.4.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "A70B40EF-071E-4805-95C0-E4622A0815B5", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.4.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "14B200A9-AA2E-411F-91CF-EB00CAA93154", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.4.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "B49A433A-1AFE-4234-A21A-308D5424B42E", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "4C28A3F8-D80A-4D5A-A96F-DFC67E806FAF", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "504FF096-8318-4905-9EBC-DB47A94310B3", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "4F5324DE-22F7-40C7-AD92-F0E089312676", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "5DDC84B0-E8DA-4CFA-9DC0-3AF87BFA8BDE", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.6.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "63C4218D-E55F-44BF-9CD2-2775A752F1CE", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "01F2B05B-EEF1-4116-87D9-B748CA217E4F", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.7.10:*:*:*:*:*:*:*", "matchCriteriaId": "93B3F3FC-00D6-4648-82C8-3BC2271162FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defennse:7.7.10.1:*:*:*:*:*:*:*", "matchCriteriaId": "3A524C68-8A74-42C4-9FA8-3F81F4FDA9F2", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.9.3a:*:*:*:*:*:*:*", "matchCriteriaId": "5B248BC8-83EE-4D84-82CE-5E0E9A857246", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.9.5a:*:*:*:*:*:*:*", "matchCriteriaId": "D247882B-DDA4-47A6-A2B0-2AFFCB94F133", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.9.6:*:*:*:*:*:*:*", "matchCriteriaId": "19F3B076-F66D-4E18-8A0A-1293C985B4A1", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.1a:*:*:*:*:*:*:*", "matchCriteriaId": "8FC4D3D8-4391-4ED6-B27B-EF47C96904CD", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.2:*:*:*:*:*:*:*", "matchCriteriaId": "60AE1B18-3CEB-45B3-A43D-3C6DCC1F20F3", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.3:*:*:*:*:*:*:*", "matchCriteriaId": "9F4AA555-A8AD-4EF1-BDED-CCB550AA7560", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.3a:*:*:*:*:*:*:*", "matchCriteriaId": "158ADFDB-D308-40AA-A445-BB9AF2F2414B", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.4:*:*:*:*:*:*:*", "matchCriteriaId": "5F44916C-A0B3-40B1-B9E5-ACED3A0ECC80", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.4a:*:*:*:*:*:*:*", "matchCriteriaId": "A685AE11-0D19-4F98-B1A1-F40C66407A20", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.4b:*:*:*:*:*:*:*", "matchCriteriaId": "8E0C23C5-4248-485F-8132-8459933EBDE5", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.5:*:*:*:*:*:*:*", "matchCriteriaId": "410D8A3B-CCD3-4BBC-BF03-63717B397E33", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.5a:*:*:*:*:*:*:*", "matchCriteriaId": "57D161E1-A275-44B1-AAC5-7A5207243A8B", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.5b:*:*:*:*:*:*:*", "matchCriteriaId": "AB1C329A-CFA4-432C-926C-AD4EE14D30BA", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.5c:*:*:*:*:*:*:*", "matchCriteriaId": "BAA951FD-37B6-4D5B-BC88-5FD6E1A670EF", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.5d:*:*:*:*:*:*:*", "matchCriteriaId": "CD3F8898-782F-49DA-8FB4-625BCB08C267", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.6:*:*:*:*:*:*:*", "matchCriteriaId": "3D17AF21-1F77-425F-9DC0-42E4F82309C7", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.13.1a:*:*:*:*:*:*:*", "matchCriteriaId": "AA3E7D96-E406-4CB5-91FC-A0FD5D94A876", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.14.1a:*:*:*:*:*:*:*", "matchCriteriaId": "07AAFFE0-B85D-4A62-894B-20A05973CC5D", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.1a:*:*:*:*:*:*:*", "matchCriteriaId": "7842C05A-F9DE-49A7-8478-A1EF324C593D", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.2a:*:*:*:*:*:*:*", "matchCriteriaId": "9A6C2814-0DAC-40AF-9494-3EEA9429F603", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.2c:*:*:*:*:*:*:*", "matchCriteriaId": "25A353E7-5F9E-4A94-BDA9-598C54572FEF", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.3:*:*:*:*:*:*:*", "matchCriteriaId": "70B8BACE-F390-402E-B80B-F57F473B1415", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.3a:*:*:*:*:*:*:*", "matchCriteriaId": "7E984118-99E5-45BC-B238-E950E62E1A77", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.4:*:*:*:*:*:*:*", "matchCriteriaId": "3825888B-D34F-466F-9E91-CBDE7A07B43C", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.4c:*:*:*:*:*:*:*", "matchCriteriaId": "2E88110E-78DE-4799-8F22-37E8B010DF81", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.16.1a:*:*:*:*:*:*:*", "matchCriteriaId": "D1D5E95D-1CE2-472B-A4C6-E098B01BA3FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.17.1:*:*:*:*:*:*:*", "matchCriteriaId": "6D8E05E5-1957-44D0-BD34-45A9AB4782B8", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.18.1:*:*:*:*:*:*:*", "matchCriteriaId": "7AB3A273-B0E6-4659-91C4-77F0192EE1DC", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.18.1a:*:*:*:*:*:*:*", "matchCriteriaId": "2FFB4BE9-4CC8-49F2-851C-F4EA098BA3AF", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.18.2:*:*:*:*:*:*:*", "matchCriteriaId": "E8759E40-63D2-4FA4-9A40-CB330413798E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.\r\n\r\nThese vulnerabilities are due to improper error checking when decompressing VBA data. An attacker could exploit these vulnerabilities by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to unexpectedly restart, causing a DoS condition."}, {"lang": "es", "value": "M\u00faltiples productos Cisco se ven afectados por vulnerabilidades en la caracter\u00edstica VBA de Snort 3 que podr\u00edan permitir a un atacante remoto no autenticado provocar la ca\u00edda del motor de detecci\u00f3n de Snort 3.\n\nEstas vulnerabilidades se deben a una comprobaci\u00f3n de errores incorrecta al descomprimir datos VBA. Un atacante podr\u00eda explotar estas vulnerabilidades enviando datos VBA manipulados al motor de detecci\u00f3n de Snort 3 en el dispositivo objetivo. Un exploit exitoso podr\u00eda permitir al atacante provocar que el motor de detecci\u00f3n de Snort 3 se reinicie inesperadamente, causando una condici\u00f3n de DoS."}], "id": "CVE-2026-20058", "lastModified": "2026-08-19T20:49:49.380", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20058", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T21:01:22.100265Z", "version": "2.0.3"}}]}, "published": "2026-03-04T18:16:20.643", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory", "Mitigation"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-786"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.9.3a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.12.1a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.12.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.13.1a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.9.5a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.12.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.14.1a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.12.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.12.3a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.15.1a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.9.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.16.1a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.12.4a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.15.2c"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.12.4b"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.15.2a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.12.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.17.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.12.5a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.15.3a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.15.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.12.5b"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.12.5c"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.15.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.18.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.18.1a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.12.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.15.4c"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.12.5d"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "17.18.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Cisco UTD SNORT IPS Engine Software", "source": "cna", "vendor": "Cisco"}, "product": "cisco_utd_snort_ips_engine_software", "vendor": "cisco"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.3.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.5.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.3.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.8.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.7.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.6.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.7.10.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.10.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Cisco Secure Firewall Threat Defense (FTD) Software", "source": "cna", "vendor": "Cisco"}, "product": "secure_firewall_threat_defense", "vendor": "cisco"}], "analysis": {"en": {"generated_at": "2026-04-17T13:05:48.088001+00:00", "value": {"mitigation_remediation": ["Apply Cisco\u2019s latest firmware or software patch that addresses the Snort\u202f3 VBA decompression flaw as detailed in the Cisco advisory.", "If a patch is not yet available, restrict traffic that may contain VBA payloads to the Snort\u202f3 interface or disable the VBA feature through the device configuration, then isolate the service with ACLs.", "Monitor system logs for repeated Snort\u202f3 engine restarts and verify the appliance\u2019s health; report anomalies to Cisco support."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Cisco Secure Firewall Threat Defense Software (FTD) and Cisco UTD SNORT IPS Engine Software are vulnerable. No specific firmware or software version ranges are listed in the advisory; administrators should check for updates on affected deployments.", "description_and_impact": "The vulnerability stems from improper error handling when decompressing VBA data in Snort\u202f3. An attacker can send specially crafted VBA data to the Snort\u202f3 Detection Engine, which will process the data without adequate bounds checking, leading to a crash. The crash causes the Snort\u202f3 engine to restart, resulting in a denial\u2011of\u2011service to the firewall\u2019s intrusion detection capabilities. The flaw is classified as CWE\u2011786 and allows only a denial of service, with no privilege escalation.", "risk_and_exploitability": "The CVSS score of 5.8 indicates moderate severity. EPSS shows a likelihood of exploitation of less than 1\u202f%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an unauthenticated remote attacker can exploit it by sending a crafted VBA payload over a network path that reaches the Snort\u202f3 engine, typically through the firewall\u2019s management or data plane. Successful exploitation results in a restart of the detection engine, interrupting packet inspection for the affected device. The condition does not require authenticated access or privileged execution, but requires the ability to reach the Snort\u202f3 service."}}}}, "created": "2026-03-05T09:06:16.396294+00:00", "updated": "2026-04-17T13:15:19.659917+00:00", "vendors": ["cisco", "cisco$PRODUCT$cisco_utd_snort_ips_engine_software", "cisco$PRODUCT$secure_firewall_threat_defense"]}