Answer in brief
CVE-2026-20221 records a Medium severity (CVSS 5.8) vulnerability in Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities. The current sources do not mark it as known exploited. The current feed maps Cisco/Cisco Cyber Vision (generic), Cisco/Cisco Open Source Snort3 (generic), Cisco/Cisco Secure Firewall Threat Defense (FTD) Software (generic), Cisco/Cisco Umbrella Insights Virtual Appliance (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Cisco/Cisco Cyber Vision (generic), Cisco/Cisco Open Source Snort3 (generic), Cisco/Cisco Secure Firewall Threat Defense (FTD) Software (generic), Cisco/Cisco Umbrella Insights Virtual Appliance (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Cisco/Cisco Cyber Visiongeneric | 3.0.0 || 3.0.2 || 3.0.3 || 3.0.1 || 3.1.0 || 3.0.4 || 3.1.1 || 3.1.2 || 3.2.0 || 3.0.5 || 3.2.1 || 3.0.6 || 3.2.2 || 3.2.3 || 3.2.4 || 4.0.0 || 4.0.1 || 4.0.2 || 4.0.3 || 4.1.0 || 4.1.1 || 4.1.2 || 4.1.3 || 4.1.4 || 4.2.0 || 4.2.1 || 4.1.5 || 4.2.2 || 4.2.X || 4.2.3 || 4.2.4 || 4.2.6 || 4.1.6 || 4.3.0 || 4.3.1 || 4.3.2 || 4.3.3 || 4.4.0 || 4.4.1 || 4.4.2 || 4.4.3 || 4.1.7 || 5.0.0 || 5.0.1 || 5.0.2 || 5.1.0 || 5.1.1 || 5.1.2 || 5.1.3 || 5.2.0 || 5.2.1 || 5.3.0 || 5.3.1 || 5.3.2 || 5.3.3 || 5.5.1 || 5.6.1 || 5.6.0 || 5.4.0 || 5.4.1 || 5.4.2 | Not reported |
| Cisco/Cisco Open Source Snort3generic | 3.12.2.0 || 3.1.2.0 || 3.1.3.0 || 3.1.4.0 || 3.1.5.0 || 3.1.6.0 || 3.1.7.0 || 3.1.8.0 || 3.1.9.0 || 3.1.10.0 || 3.1.12.0 || 3.1.13.0 || 3.1.14.0 || 3.1.15.0 || 3.1.16.0 || 3.1.17.0 || 3.1.18.0 || 3.1.19.0 || 3.1.20.0 || 3.1.21.0 || 3.1.22.0 || 3.1.23.0 || 3.1.24.0 || 3.1.25.0 || 3.1.27.0 || 3.1.28.0 || 3.1.29.0 || 3.1.30.0 || 3.1.31.0 || 3.1.32.0 || 3.1.36.0 || 3.1.38.0 || 3.1.39.0 || 3.1.40.0 || 3.1.41.0 || 3.1.42.0 || 3.1.43.0 || 3.1.45.0 || 3.1.47.0 || 3.1.48.0 || 3.1.50.0 || 3.1.51.0 || 3.1.52.0 || 3.1.53.0 || 3.1.55.0 || 3.1.56.0 || 3.1.57.0 || 3.1.58.0 || 3.1.59.0 || 3.1.60.0 || 3.1.61.0 || 3.1.62.0 || 3.1.63.0 || 3.1.64.0 || 3.1.65.0 || 3.1.66.0 || 3.1.67.0 || 3.1.69.0 || 3.1.70.0 || 3.1.71.0 || 3.1.72.0 || 3.1.73.0 || 3.1.74.0 || 3.1.75.0 || 3.1.76.0 || 3.1.77.0 || 3.1.78.0 || 3.1.81.0 || 3.1.82.0 || 3.1.83.0 || 3.1.84.0 || 3.2.1.0 || 3.2.2.0 || 3.3.0.0 || 3.3.1.0 || 3.3.2.0 || 3.3.3.0 || 3.3.4.0 || 3.3.5.0 || 3.3.7.0 || 3.5.0.0 || 3.5.1.0 || 3.8.1.0 || 3.6.0.0 || 3.6.2.0 || 3.9.3.0 || 3.7.2.0 || 3.7.0.0 || 3.9.6.0 || 3.10.0.0 || 3.10.2.0 || 3.7.4.0 || 3.9.0.0 || 3.5.2.0 || 3.12.1.0 || 3.6.1.0 || 3.9.2.0 || 3.6.3.0 || 3.9.5.0 || 3.7.1.0 || 3.9.7.0 || 3.7.3.0 || 3.10.1.0 || 3.9.1.0 || 3.11.1.0 | Not reported |
| Cisco/Cisco Secure Firewall Threat Defense (FTD) Softwaregeneric | 7.0.0 || 7.0.0.1 || 7.0.1 || 7.0.1.1 || 7.0.2 || 7.2.0 || 7.0.2.1 || 7.0.3 || 7.2.0.1 || 7.0.4 || 7.2.1 || 7.0.5 || 7.3.0 || 7.2.2 || 7.2.3 || 7.3.1 || 7.2.4 || 7.0.6 || 7.2.5 || 7.2.4.1 || 7.3.1.1 || 7.4.0 || 7.0.6.1 || 7.2.5.1 || 7.4.1 || 7.2.6 || 7.0.6.2 || 7.4.1.1 || 7.2.7 || 7.2.5.2 || 7.3.1.2 || 7.2.8 || 7.6.0 || 7.4.2 || 7.2.8.1 || 7.0.6.3 || 7.4.2.1 || 7.2.9 || 7.0.7 || 7.7.0 || 7.4.2.2 || 7.2.10 || 7.6.1 || 7.4.2.3 || 7.0.8 || 7.6.2 || 7.7.10 || 7.7.11 || 7.0.8.1 || 7.6.2.1 || 7.7.10.1 || 7.4.2.4 || 7.2.10.2 || 7.4.3 || 7.6.4 || 10.0.0 || 7.4.4 || 7.0.9 || 7.2.11 || 7.4.7 | Not reported |
| Cisco/Cisco Umbrella Insights Virtual Appliancegeneric | 2.6.0 || 2.5.6 || 2.5 || 2.4.12 || 2.7 || 2.6.2 || 2.5.5 || 2.5.4 || 2.8 || 2.6.1 || 2.5.7 || 1.5.4 || 1.5.5 || 1.5.6 || 2.0.0 || 2.0.2 || 2.0.3 || 2.1.0 || 2.1.2 || 2.1.4 || 2.1.5 || 2.2 || 2.2.1 || 2.3 || 2.3.1 || 2.4 || 2.4.4 || 2.4.6 || 2.8.9 || 3.0 || 3.1 || 3.2 || 2.8.1 || 2.8.2 || 2.8.3 || 2.8.4 || 2.8.5 || 3.0.1 || 3.0.2 || 3.0.4 || 3.0.5 || 3.1.1 || 3.1.2 || 3.1.3 || 3.1.4 || 3.2.1 || 3.2.2 || 3.2.3 || 3.3 || 3.3.1 || 3.3.2 || 3.3.3 || 3.3.4 || 3.4 || 3.4.1 || 3.4.2 || 3.4.3 || 3.4.4 || 3.4.5 || 3.4.6 || 3.5 || 2.7.1 || 2.7.2 || 2.7.6 || 2.7.9 || 2.7.10 || 3.5.1 || 3.5.2 || 3.6.1 || 3.6.2 || 3.7 || 3.7.1 || 3.8.3 | Not reported |
| Cisco/Cisco UTD SNORT IPS Engine Softwaregeneric | 3.17.1S || 16.12.3 || Fuji-16.9.5 || 16.12.4 || 17.3.1a || 16.6.6 || 16.12.2 || Fuji-16.9.6 || 3.17.0S || Fuji-16.9.3 || Denali-16.3.7 || Fuji-16.9.2 || Fuji-16.9.4 || Everest-16.6.4 || Everest-16.6.3 || 16.6.5 || Denali-16.3.5 || 17.2.1r || 17.1.1 || Everest-16.6.2 || 16.6.7a || Denali-16.3.4 || 16.6.1 || Denali-16.3.9 || Denali-16.3.3 || 16.12.1a || 17.3.2 || 17.4.1a || 16.12.5 || 17.5.1 || Fuji-16.9.7 || 16.6.9 || 17.3.3 || 17.5.1a || 17.3.4 || 17.3.4a || 17.4.2 || 17.4.1b || 17.6.1a || 16.6.10 || 17.7.1a || 16.12.6 || Fuji-16.9.8 || 17.6.2 || 17.8.1a || 16.12.7 || 17.3.5 || 17.6.3 || 17.6.3a || 17.7.2 || 17.9.1a || 17.6.4 || 17.10.1a || 17.3.6 || 16.12.8 || 17.3.7 || 17.9.2a || 17.6.5 || 17.11.1a || 17.9.3a || 17.12.1a || 17.9.4 || 17.6.6 || 17.3.8 || 17.3.8a || 17.6.6a || 17.9.4a || 17.12.2 || 17.13.1a || 17.9.5a || 17.12.3 || 17.6.7 || 17.14.1a || 17.12.4 || 17.12.3a || 17.15.1a || 17.6.8 || 17.9.6 || 17.6.8a || 17.16.1a || 17.9.5e || 17.12.4a || 17.15.2c || 17.9.5f || 17.12.4b || 17.15.2a || 17.12.5 || 17.17.1 || 17.12.5a || 17.9.7a || 17.15.3a || 17.15.3 || 17.12.5b || 17.12.5c || 17.15.4 || 17.9.7b || 17.18.1 || 17.18.1a || 17.12.6 || 17.9.8 || 17.15.4c || 17.12.5d || 17.18.2 || 26.1.1 || 17.15.5 || 17.15.5a || 17.12.7 || 17.12.7a || 17.12.7b || 17.9.9 || 17.18.3a || 17.12.8 || 17.15.6 || 17.18.4 || 26.1.2 || 17.9.10 | Not reported |
Published upstream
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 21, 2026
Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine. This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required.
Quoted source text, attributed separately from HOL analysis.