CVE-2026-76524: Missing Authentication for Critical Function in Cisco Cisco Open Source Snort3

The vulnerability in Cisco Open Source Snort 3 arises from missing authentication on the control channel socket implementation. An authenticated local attacker with low privileges can exploit this by connecting to the Snort 3 control channel socket, enabling arbitrary command execution as the Snort 3 process user and access to Snort 3 process memory. This issue affects numerous specific versions of Snort 3 as enumerated in the affectedVersions list. The CVSS 3.1 score of 7.8 reflects high impact on confidentiality, integrity, and availability.

Successful exploitation allows a local attacker with low privileges to execute arbitrary commands with the privileges of the Snort 3 process user. The attacker can also read and write Snort 3 process memory, potentially leading to full compromise of the Snort 3 process and its data. This impacts confidentiality, integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to systems running vulnerable versions of Snort 3 to trusted users only. Monitor for any vendor updates or patches addressing this vulnerability.