CVE-2026-20027: Cisco Secure Firewall Threat Defense (FTD) Software · Information Exposure
Affects Cisco Secure Firewall Threat Defense (FTD) SoftwareSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 48% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 7 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| CiscoCisco Secure Firewall Threat Defense (FTD) Software | Affected
| Fixed in– |
| CiscoCisco UTD SNORT IPS Engine Software | Affected
| Fixed in– |
AI-suggested
Organizations should prioritize applying official Cisco patches or updates addressing CVE-2026-20027 as soon as they become available. In the interim, network administrators should consider limiting or blocking unnecessary DCE/RPC traffic at network boundaries or within segmented environments to reduce exposure. Deploying strict access controls and network segmentation can minimize the attack surface by restricting which systems can send DCE/RPC requests inspected by Cisco FTD devices. Monitoring network traffic for unusual spikes or patterns in DCE/RPC requests can help detect attempted exploitation. Additionally, reviewing and hardening Snort 3 detection engine configurations to minimize exposure to malformed packets may reduce risk. Organizations should also ensure comprehensive logging and alerting are enabled on Cisco FTD devices to facilitate rapid incident response. Coordination with Cisco support and threat intelligence teams can provide timely updates and guidance. Finally, conducting internal audits to identify all affected Cisco FTD versions in use will help prioritize remediation efforts.
Description
Multiple Cisco products are affected by a vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive information or to restart, resulting in an interruption of packet inspection. This vulnerability is due to an error in buffer handling logic when processing DCE/RPC requests, which can result in a buffer out-of-bounds read. An attacker could exploit this vulnerability by sending a large number of DCE/RPC requests through an established connection that is inspected by Snort 3. A successful exploit could allow the attacker to obtain sensitive information in the Snort 3 data stream.