CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-20290
Advisory Summary
🗓️ Calendar • September 16, 2026
🔐 🧩 Cisco Secure Firewall Threat Defense (FTD) — Snort 2 SSL/TLS DoS Vulnerability (CVE-2026-20290)
- A vulnerability exists in Snort 2 Detection Engine SSL/TLS certificate parsing within Cisco Secure Firewall Threat Defense (FTD) software.
- An unauthenticated remote attacker may trigger the Snort 2 engine to restart unexpectedly, causing a Denial of Service (DoS) condition.
- Root cause: incomplete validation of SSL certificates during crafted handshake/setup request processing.
- Send a crafted SSL connection setup request designed to be parsed by Snort 2.
- If successful, the Snort 2 Detection Engine fails into a restart loop/event, degrading or interrupting inspection and detection capacity.
- Rating: Medium
- Primary risk is availability (inspection/detection disruption), which can indirectly enable broader compromise by reducing security visibility during outages.
- Cisco has released software updates that address the issue.
- No workarounds are available per the advisory—plan for patching/upgrade as the controlling measure.
- Verify affected deployments of FTD Snort 2 versions in your customer base and roadmap the relevant fixed releases.
- Prioritize environments with high inbound TLS/inspection traffic where detection engine restarts would be most disruptive.
- After updating, validate operational health (Snort engine stability, detection continuity, and logs/telemetry).
-2026-20290
Reference: Vendor Advisory