Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Cisco Releases Security Hardening Guidance for Multiple Cisco Products

The critical advisory addresses multiple vulnerability classes affecting multiple Cisco products

Threat ID:
CC-4878
Threat Severity:
Medium
Published:
22 October 2026 2:44 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

The critical advisory addresses multiple vulnerability classes affecting multiple Cisco products

Threat details

Introduction

Cisco has published a security hardening advisory for multiple Cisco products following a comprehensive internal security review. The update addresses multiple vulnerability classes including out-of-bounds write, incorrect calculation, improper privilege management, and uncontrolled resource consumption vulnerabilities. Cisco states that these vulnerabilities were discovered during internal testing and are not known to be actively exploited.

To streamline disclosure, Cisco grouped vulnerabilities according to their underlying Common Weakness Enumeration (CWE) category and assigned a single Common Vulnerabilities and Exposures (CVE) identifier to each group.

Vulnerability Details

  • CVE-2026-20236 - 'Incorrect calculation' vulnerability - CVSSv3.1 score: 9.0.
  • CVE-2026-20043 - 'Out-of-bounds write' vulnerability -  CVSSv3.1 score: 9.0.
  • CVE-2026-20291 - 'Improper privilege management'  vulnerability - CVSSv3.1 score: 7.8.
  • CVE-2026-20356 - 'Uncontrolled resource consumption' vulnerability - CVSSv3.1 score: 7.5.

Remediation advice

Affected organisations are urged to review Cisco's cisco-sa-hardening-snort3-ybgmhTQe advisory, assess exposure, and prioritise applying relevant updates.

Cisco has released software updates to address these vulnerabilities and states that no workarounds are available.

CVE Vulnerabilities

Status Published

CVE-2026-20236

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20236 are related to issues concerning incorrect calculation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-682.
Status Published

CVE-2026-20043

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20043 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.
Status Published

CVE-2026-20291

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20291 are related to issues concerning improper privilege management that are grouped under the Common Weakness Enumeration (CWE) Base CWE-269
Status Published

CVE-2026-20356

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20356 are related to issues concerning uncontrolled resource consumption that are grouped under the Common Weakness Enumeration (CWE) Base CWE-400.

Last edited: 22 October 2026 2:44 pm