CVE-2026-20290: Cisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service Vulnerability
Tech GuruQuick Answer
CVE-2026-20290 can restart Snort 2 when it parses a crafted SSL connection setup request from an unauthenticated remote attacker. Check vulnerable Open Source Snort 2 installations and FTD devices actually running Snort 2, not the ASA/FTD family label alone. Cisco provides no workaround. Standalone Snort users need Snort-specific fixed-release guidance; FTD operators need their platform's First Fixed result.
Fix Or Immediate Action
What to do now: Confirm the affected product, release, and configuration. Cisco provides no workaround; reduce exposure where operationally feasible. Enter the exact installed product, platform, and release in Cisco Software Checker and upgrade to the returned First Fixed release. The CVE-specific live advisory and Cisco Software Checker result control the First Fixed release; any combined hardening baseline is supplemental only.
Last verified: 2026-09-17 UTC from Cisco's advisory and CSAF record. Recheck both the affected-products and fixed-software sections before a production change.
Context
Scope And Impact In Plain Language
Who should check: Operators of affected Open Source Snort 2 releases and FTD deployments running Snort 2. The broad ASA/FTD family label does not establish that ASA or an FTD device running another engine is affected.
When this applies: Verify the active Snort engine and installed release, not just the FTD major version. The detailed scope below retains Cisco's different defaults for new installations and older upgraded installations, plus the Snort 2 deprecation boundary.
What could happen: An unauthenticated remote attacker may send a crafted SSL connection setup request that causes Snort 2's certificate parser to restart the detection engine. The described interruption is to that engine; this notice does not establish a full firewall reload.
Not sure? Find the exact product, platform, and version in the management interface or CLI, then compare them with this CVE's affected-products section in Cisco's live advisory.
Status At A Glance
| Product scope | Cisco Secure Firewall ASA / FTD |
|---|---|
| CVE | CVE-2026-20290 |
| TechGeeks response tier | P2 — review and schedule |
| Publication | New final Cisco advisory |
| First published | 2026-09-16T16:00:00+00:00 |
| Last updated | 2026-09-16T16:00:00+00:00 |
| Cisco advisory SIR | Medium |
| CVE-specific Cisco SIR | Not separately stated |
| CVSS base score / severity | 5.8 — Medium |
| CVSS vector | CVSS v3.1 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L |
| CISA KEV at last check | No — this is separate from Cisco severity and is not proof of no exploitation. |
| Cisco exploitation statement | The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. |
What Happened
Incomplete SSL certificate validation in the Snort 2 detection engine can cause an unexpected engine restart during connection setup. Cisco describes a denial of service to that engine, not a demonstrated full firewall reload. Software fixes are available and no workaround is documented. The scope section retains the different engine defaults for fresh and upgraded FTD installations and the Snort 2 deprecation boundary, so a major FTD version alone is not the applicability test.
Affected Scope
For information about which products were affected by this vulnerability at the time of publication, see the following sections. Open Source Snort 2 At the time of publication, this vulnerability affected Open Source Snort 2. For information about which Snort releases were vulnerable at the time of publication, see the Fixed Software section of this advisory. For more information on Snort, see the Snort website. Cisco Secure FTD Software At the time of publication, these vulnerabilities affected Cisco Secure FTD Software if Snort 2 was configured. For information about which Cisco Secure FTD Software releases are vulnerable, see the Fixed Software section of this advisory. Determine the Snort Configuration on Cisco Secure FTD Software On new installations of Cisco Secure FTD Software releases 7.0.0 and later, Snort 3 is running by default. On devices that were running Cisco Secure FTD Software Release 6.7.0 or earlier and were upgraded to Release 7.0.0 or later, Snort 2 is running by default. Snort 2 was deprecated in Cisco Secure FTD Software releases 7.7.0 and later. To determine which Snort version is running on Cisco Secure FTD Software, see Determine the Active Snort Version that Runs on Firepower Threat Defense (FTD).
Match the exact hardware or virtual platform, installed train, patch level, enabled service, role, and management or data-plane exposure. A Cisco product-family name alone does not establish applicability.
Steps
What To Do Now
- Confirm. Inventory Cisco Secure Firewall ASA / FTD and record platform, exact release, patch level, enabled feature, role, and exposure.
- Preserve. Save UTC context plus off-device authentication, management, firewall, network, endpoint, and SIEM evidence before logs rotate or a disruptive change removes context.
- Scope. Compare each asset with the live Cisco advisory, including configuration prerequisites and exclusions.
- Reduce exposure. Cisco documents no workaround for this CVE. Use only supported exposure controls while preparing the permanent fix.
- Remediate. Follow the CVE-specific method and release guidance under Permanent Fix below.
- Validate. Confirm the resulting version, service health, logging, expected access, an expected denial, failover or cluster state, and representative dependent workflows.
- Escalate. If evidence or exposure creates concern, open incident response and Cisco TAC recovery work rather than treating patch completion as proof of trust.
Fixed Releases And Mitigation
Permanent Fix
Cisco method: Use Cisco Software Checker with the exact installed product, platform, and release to obtain the advisory-specific First Fixed release; the combined September hardening baseline is also recorded.
No compact per-CVE fixed-release table is reproduced here because Cisco may use different First Fixed values by CVE and software train. Use this CVE's live advisory table or Cisco Software Checker; do not infer a fixed release from a combined hardening baseline or another Cisco notice.
Workaround Or Temporary Mitigation
No vendor workaround is documented for CVE-2026-20290. Use supported exposure controls only as temporary risk reduction while preparing the permanent software fix.
Important boundary: A workaround, ACL, exposure reduction, or service restriction can reduce risk while the update is prepared, but it does not patch the vulnerable code, prove every attack path is closed, or erase an earlier compromise.
Investigation And Recovery
Review management authentication, account and privilege changes, API and web requests, configuration changes, crashes or restarts, resource pressure, and relevant external network telemetry for the vulnerable period. Preserve original evidence and follow Cisco TAC or incident-response guidance for containment, credential rotation, trusted rebuild, or service restoration when findings warrant it.
Notes
Exploitation Evidence
Cisco's exact status at the last check: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
This CVE was not present in the TechGeeks CISA KEV snapshot at the last check. Cisco's 'not aware' statement and absence from KEV are time-bounded evidence, not claims that exploitation is impossible or has never happened. Severity and exploitation status remain separate signals.
Validation And Boundaries
This notice is documentation-backed. TechGeeks did not reproduce the exploit or independently test every fixed build. It does not prove that all members of the product family are affected, that the activity is widespread, that a clean indicator search excludes compromise, or that an update restored trust. Cisco's live advisory controls affected and fixed release information.
Related TechGeeks Resources
- TechGeeks Security Notice Center
- All Security Notices
- What to Do When a Device Hits CISA KEV
- Router CVE Exposure, Version, and Mitigation Checklist
- IoT Firmware Update and End-of-Support Checklist
- Live Protect and Runtime Vulnerability Shielding
References
Wrap-Up
Record whether CVE-2026-20290 applies. If it does, assign an owner and deadline appropriate to the Medium Cisco advisory SIR, preserve the evidence, complete Cisco's remediation, and document the validated result.
Correction policy: A material Cisco revision to scope, severity, exploitation status, workarounds, fixed software, or recovery guidance triggers an update and a new verification date.
