CVE-2026-20006: Cisco Firepower Threat Defense Software and Cisco FirePOWER Services TLS with Snort 3 Denial of Service Vulnerability

Published Mar 4, 2026

Updated

A vulnerability in the TLS cryptography functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to unexpectedly restart, resulting in a denial of service (DoS) condition. This vulnerability is due to improper implementation of the TLS protocol. An attacker could exploit this vulnerability by sending a crafted TLS packet to an affected system. A successful exploit could allow the attacker to cause a device that is running Cisco Secure FTD Software to drop network traffic, resulting in a DoS condition.  Note: TLS 1.3 is not affected by this vulnerability.

Affected Software

34 affected components

Cisco Secure Firewall Threat Defense (FTD) Software

Cisco Secure Firewall Threat Defense=7.2.0

Cisco Secure Firewall Threat Defense=7.2.0.1

Cisco Secure Firewall Threat Defense=7.2.1

Cisco Secure Firewall Threat Defense=7.2.2

Cisco Secure Firewall Threat Defense=7.2.3

Cisco Secure Firewall Threat Defense=7.2.4

Cisco Secure Firewall Threat Defense=7.2.4.1

Cisco Secure Firewall Threat Defense=7.2.5

Cisco Secure Firewall Threat Defense=7.2.5.1

Cisco Secure Firewall Threat Defense=7.2.5.2

Cisco Secure Firewall Threat Defense=7.2.6

Cisco Secure Firewall Threat Defense=7.2.7

Cisco Secure Firewall Threat Defense=7.2.8

Cisco Secure Firewall Threat Defense=7.2.8.1

Cisco Secure Firewall Threat Defense=7.2.9

Cisco Secure Firewall Threat Defense=7.2.10

Cisco Secure Firewall Threat Defense=7.2.10.2

Cisco Secure Firewall Threat Defense=7.3.0

Cisco Secure Firewall Threat Defense=7.3.1

Cisco Secure Firewall Threat Defense=7.3.1.1

Cisco Secure Firewall Threat Defense=7.3.1.2

Cisco Secure Firewall Threat Defense=7.4.0

Cisco Secure Firewall Threat Defense=7.4.1

Cisco Secure Firewall Threat Defense=7.4.1.1

Cisco Secure Firewall Threat Defense=7.4.2

Cisco Secure Firewall Threat Defense=7.4.2.1

Cisco Secure Firewall Threat Defense=7.4.2.2

Cisco Secure Firewall Threat Defense=7.4.2.3

Cisco Secure Firewall Threat Defense=7.4.2.4

Cisco Secure Firewall Threat Defense=7.6.0

Cisco Secure Firewall Threat Defense=7.6.1

Cisco Secure Firewall Threat Defense=7.6.2

Cisco Secure Firewall Threat Defense=7.6.2.1

Event History

Mar 4, 2026

CVE Published

via MITRE·05:37 PM

Data Sourced

via MITRE·05:37 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-20006?

CVE-2026-20006 is classified as a high severity vulnerability due to its potential to cause a denial of service.

How do I fix CVE-2026-20006?

To remediate CVE-2026-20006, it is recommended to apply the latest security patches provided by Cisco for Firepower Threat Defense Software.

What systems are affected by CVE-2026-20006?

CVE-2026-20006 affects Cisco Secure Firewall Threat Defense Software and Cisco FirePOWER Services utilizing the Snort 3 Detection Engine.

Is CVE-2026-20006 exploitable remotely?

Yes, CVE-2026-20006 can be exploited remotely by unauthenticated attackers.

What types of attacks can CVE-2026-20006 facilitate?

CVE-2026-20006 can facilitate denial of service attacks against the vulnerable systems.