CVE-2026-20043
Cisco Cisco Cyber Vision
- Cisco Cisco Cyber Vision
- Critical
- CVSS 9.0
- EPSS 0.26%
- No fixed version listed here
What to do
No fixed version listed here
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Cyber Vision | 3.0.0; 3.0.2; 3.0.3; 3.0.1; 3.1.0; 3.0.4; 3.1.1; 3.1.2; 3.2.0; 3.0.5; 3.2.1; 3.0.6; 3.2.2; 3.2.3; 3.2.4; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.2.0; 4.2.1; 4.1.5; 4.2.2; 4.2.X; 4.2.3 | Only in the CVE record |
| Cisco Cisco Open Source Snort3 | 3.12.2.0; 3.1.2.0; 3.1.3.0; 3.1.4.0; 3.1.5.0; 3.1.6.0; 3.1.7.0; 3.1.8.0; 3.1.9.0; 3.1.10.0; 3.1.12.0; 3.1.13.0; 3.1.14.0; 3.1.15.0; 3.1.16.0; 3.1.17.0; 3.1.18.0; 3.1.19.0; 3.1.20.0; 3.1.21.0; 3.1.22.0; 3.1.23.0; 3.1.24.0; 3.1.25.0; 3.1.27.0; 3.1.28.0; 3.1.29.0; 3.1.30.0; 3.1.31.0; 3.1.32.0 | Only in the CVE record |
| Cisco Cisco Secure Firewall Threat Defense (FTD) Software | 7.0.0; 7.0.0.1; 7.0.1; 7.0.1.1; 7.0.2; 7.0.2.1; 7.0.3; 7.2.0.1; 7.0.4; 7.2.1; 7.0.5; 7.3.0; 7.2.2; 7.2.3; 7.3.1; 7.2.4; 7.0.6; 7.2.5; 7.2.4.1; 7.3.1.1; 7.4.0; 7.0.6.1; 7.2.5.1; 7.4.1; 7.2.6; 7.0.6.2; 7.4.1.1; 7.2.7; 7.2.5.2; 7.3.1.2 | Only in the CVE record |
| Cisco Cisco UTD SNORT IPS Engine Software | 17.3.1a; 17.3.2; 17.4.1a; 17.5.1; 17.3.3; 17.5.1a; 17.3.4; 17.3.4a; 17.4.2; 17.4.1b; 17.6.1a; 17.7.1a; 17.6.2; 17.8.1a; 17.3.5; 17.6.3; 17.6.3a; 17.7.2; 17.9.1a; 17.6.4; 17.10.1a; 17.3.6; 17.3.7; 17.9.2a; 17.6.5; 17.11.1a; 17.9.3a; 17.12.1a; 17.9.4; 17.6.6 | Only in the CVE record |
The CVE record lists 192 ranges this page cannot state exactly.
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.0 (v3.1, scored by cisco)
- EPSS
- 0.26% chance of exploitation in the next 30 days (EPSS from FIRST, as of Oct 23, 2026)
- CISA's SSVC decision points
- Exploitation: none. Automatable: no. Technical impact: total. As of Oct 21, 2026.
- Weakness
- CWE-787: Out-of-bounds Write
- Vendor
- Cisco, Cisco Cyber Vision
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.