Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability

MonitorCVSS 5.8cisco-sa-snort3-gre-JNpMHrTvOct 21, 2026

CiscoTransportation

IT in OT - Cisco networking products are commonly deployed in OT environments

Attack path

Attack VectorNetwork

Auth RequiredNone

ComplexityLow

User InteractionNone needed

Summary

Multiple Cisco products using Snort 3 Detection Engine versions 1.5.4 through 5.6.1 are vulnerable to a denial of service condition in the generic routing encapsulation (GRE) tunnel decapsulation feature. Improper handling of nested GRE traffic allows an unauthenticated, remote attacker to send a crafted GRE payload that triggers an unexpected restart of the Snort 3 Detection Engine. A successful exploit could result in either a bypass or denial of service condition, depending on device configuration. The Snort 3 Detection Engine restarts automatically.

What this means

What could happen

An attacker can remotely crash your Snort 3 Detection Engine by sending malformed GRE traffic, causing temporary loss of intrusion detection capabilities or a brief detection bypass, depending on your failover configuration. If Snort is your primary detection mechanism for malicious network traffic, this interruption could allow attacks to slip through undetected.

Who's at risk

Organizations in transportation and other sectors that deploy Cisco products with integrated Snort 3 Detection Engine (such as Cisco security appliances, threat defense systems, and network monitoring solutions) for intrusion detection and prevention.

How it could be exploited

An attacker sends a crafted GRE tunnel packet over the network to a device running vulnerable Snort 3 software. Snort attempts to decapsulate the malformed nested GRE payload, triggers a crash condition, and the Detection Engine restarts automatically. During the restart window, no intrusion detection occurs.

Prerequisites

Network access to the device running Snort 3 Detection Engine on ports/protocols it monitors
No authentication required

remotely exploitableno authentication requiredlow complexity

Exploitability

Unlikely to be exploited — EPSS score 0.4%

Affected products (1)

ProductAffected VersionsFix Status

Multiple Cisco Products Snort 3 Generic Routing Encapsulation1.5.4 through 5.6.1Fix available

Remediation & Mitigation

0/1

Schedule — requires maintenance window

0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpgrade to Snort 3 version 5.6.2 or later

CVEs (1)

CVE-2026-20221

View full vendor advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/88d16e22-56a7-4d09-a9d6-8074ce9f9fdb

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.