According to its self-reported version, Cisco IOS-XE Software is affected by the following vulnerabilities:

  - A vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker     to cause the Snort 3 Detection Engine to leak sensitive information or to restart, resulting in an     interruption of packet inspection. This vulnerability is due to an error in buffer handling logic when     processing DCE/RPC requests, which can result in a buffer use-after-free read. An attacker could exploit     this vulnerability by sending a large number of DCE/RPC requests through an established connection that is     inspected by Snort 3. A successful exploit could allow the attacker to unexpectedly restart the Snort 3     Detection Engine, which could cause a denial of service (DoS). (CVE-2026-20026)

  - A vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker     to cause the Snort 3 Detection Engine to leak sensitive information or to restart, resulting in an     interruption of packet inspection. This vulnerability is due to an error in buffer handling logic when     processing DCE/RPC requests, which can result in a buffer out-of-bounds read. An attacker could exploit     this vulnerability by sending a large number of DCE/RPC requests through an established connection that is     inspected by Snort 3. A successful exploit could allow the attacker to obtain sensitive information in the     Snort 3 data stream. (CVE-2026-20027)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Detections

Analytics

Cisco IOS XE Software Unified Threat Defense Snort Intrusion Prevention System Engine Multiple Vulnerabilities (cisco-sa-snort3-dcerpc-vulns-J9HNF4tH)

medium Nessus Plugin ID 290255

Version 1.2

Version 1.1

Version 1.2 Feb 6, 2026, 8:56 AM CVSS metrics ("CVSSv3 score" set to 5.3) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N") CVSSv2 score source (changed from "CVE-2026-20026" to "CVE-2026-20027") Plugin Feed: 202602060856
Version 1.1 Jan 16, 2026, 10:12 PM New Plugin Feed: 202601162212