How to Fix CVE-2026-20068: Cisco Cyber Vision (Bundle Sibling)
By Sai Kiran Pandrala. Last verified: 2026-05-25.
CVE-2026-20068 is a sibling vulnerability in the same vendor advisory as CVE-2026-20005. Apply the same patched build and you close both. The technical detail below is what differs.
| Severity | 5.8 (Medium) |
|---|---|
| Actively exploited? | No public listing in CISA KEV |
| Affected | Cisco Cyber Vision 3.0.0; Cisco Cyber Vision 3.0.2; Cisco Cyber Vision 3.0.3; Cisco Cyber Vision 3.0.1; Cisco Cyber Vision 3.1.0; Cisco Cyber Vision 3.0.4; Cisco Cyber Vision 3.1.1; Cisco Cyber Vision 3.1.2; Cisco Cyber Vision 3.2.0; Cisco Cyber Vision 3.0.5; Cisco Cyber Vision 3.2.1; Cisco Cyber Vision 3.0.6; Cisco Cyber Vision 3.2.2; Cisco Cyber Vision 3.2.3; Cisco Cyber Vision 3.2.4; Cisco Cyber Vision 4.0.0; Cisco Cyber Vision 4.0.1; Cisco Cyber Vision 4.0.2; Cisco Cyber Vision 4.0.3; Cisco Cyber Vision 4.1.0; Cisco Cyber Vision 4.1.1; Cisco Cyber Vision 4.1.2; Cisco Cyber Vision 4.1.3; Cisco Cyber Vision 4.1.4; Cisco Cyber Vision 4.2.0; Cisco Cyber Vision 4.2.1; Cisco Cyber Vision 4.1.5; Cisco Cyber Vision 4.2.2; Cisco Cyber Vision 4.2.X; Cisco Cyber Vision 4.2.3; Cisco Cyber Vision 4.2.4; Cisco Cyber Vision 4.2.6; Cisco Cyber Vision 4.1.6; Cisco Cyber Vision 4.3.0; Cisco Cyber Vision 4.3.1; Cisco Cyber Vision 4.3.2; Cisco Cyber Vision 4.3.3; Cisco Cyber Vision 4.4.0; Cisco Cyber Vision 4.4.1; Cisco Cyber Vision 4.4.2; Cisco Cyber Vision 4.4.3; Cisco Cyber Vision 4.1.7; Cisco Cyber Vision 5.0.0; Cisco Cyber Vision 5.0.1; Cisco Cyber Vision 5.0.2; Cisco Cyber Vision 5.1.0; Cisco Cyber Vision 5.1.1; Cisco Cyber Vision 5.1.2; Cisco Cyber Vision 5.1.3; Cisco Cyber Vision 5.2.0; Cisco Cyber Vision 5.2.1; Cisco Cyber Vision 5.3.0; Cisco Cyber Vision 5.3.1; Cisco Cyber Vision 5.3.2; Cisco Secure Firewall Threat Defense (FTD) Software 7.2.4; Cisco Secure Firewall Threat Defense (FTD) Software 7.2.5; Cisco Secure Firewall Threat Defense (FTD) Software 7.2.4.1; Cisco Secure Firewall Threat Defense (FTD) Software 7.4.0; Cisco Secure Firewall Threat Defense (FTD) Software 7.2.5.1; Cisco Secure Firewall Threat Defense (FTD) Software 7.4.1; Cisco Secure Firewall Threat Defense (FTD) Software 7.2.6; Cisco Secure Firewall Threat Defense (FTD) Software 7.4.1.1; Cisco Secure Firewall Threat Defense (FTD) Software 7.2.7; Cisco Secure Firewall Threat Defense (FTD) Software 7.2.5.2; Cisco Secure Firewall Threat Defense (FTD) Software 7.2.8; Cisco Secure Firewall Threat Defense (FTD) Software 7.6.0; Cisco Secure Firewall Threat Defense (FTD) Software 7.4.2; Cisco Secure Firewall Threat Defense (FTD) Software 7.2.8.1; Cisco Secure Firewall Threat Defense (FTD) Software 7.4.2.1; Cisco Secure Firewall Threat Defense (FTD) Software 7.2.9; Cisco Secure Firewall Threat Defense (FTD) Software 7.7.0; Cisco Secure Firewall Threat Defense (FTD) Software 7.4.2.2; Cisco Secure Firewall Threat Defense (FTD) Software 7.2.10; Cisco Secure Firewall Threat Defense (FTD) Software 7.6.1; Cisco Secure Firewall Threat Defense (FTD) Software 7.4.2.3; Cisco Secure Firewall Threat Defense (FTD) Software 7.6.2; Cisco Secure Firewall Threat Defense (FTD) Software 7.7.10; Cisco Secure Firewall Threat Defense (FTD) Software 7.6.2.1; Cisco Secure Firewall Threat Defense (FTD) Software 7.7.10.1; Cisco Secure Firewall Threat Defense (FTD) Software 7.4.2.4; Cisco Secure Firewall Threat Defense (FTD) Software 7.2.10.2; Cisco Secure Firewall Threat Defense (FTD) Software 7.4.3; Cisco UTD SNORT IPS Engine Software 17.3.1a; Cisco UTD SNORT IPS Engine Software 17.2.1r; Cisco UTD SNORT IPS Engine Software 17.3.2; Cisco UTD SNORT IPS Engine Software 17.4.1a; Cisco UTD SNORT IPS Engine Software 17.5.1; Cisco UTD SNORT IPS Engine Software 17.3.3; Cisco UTD SNORT IPS Engine Software 17.5.1a; Cisco UTD SNORT IPS Engine Software 17.3.4; Cisco UTD SNORT IPS Engine Software 17.3.4a; Cisco UTD SNORT IPS Engine Software 17.4.2; Cisco UTD SNORT IPS Engine Software 17.4.1b; Cisco UTD SNORT IPS Engine Software 17.6.1a; Cisco UTD SNORT IPS Engine Software 17.7.1a; Cisco UTD SNORT IPS Engine Software 17.6.2; Cisco UTD SNORT IPS Engine Software 17.8.1a; Cisco UTD SNORT IPS Engine Software 17.3.5; Cisco UTD SNORT IPS Engine Software 17.6.3; Cisco UTD SNORT IPS Engine Software 17.6.3a; Cisco UTD SNORT IPS Engine Software 17.7.2; Cisco UTD SNORT IPS Engine Software 17.9.1a; Cisco UTD SNORT IPS Engine Software 17.6.4; Cisco UTD SNORT IPS Engine Software 17.10.1a; Cisco UTD SNORT IPS Engine Software 17.3.6; Cisco UTD SNORT IPS Engine Software 17.3.7; Cisco UTD SNORT IPS Engine Software 17.9.2a; Cisco UTD SNORT IPS Engine Software 17.6.5; Cisco UTD SNORT IPS Engine Software 17.11.1a; Cisco UTD SNORT IPS Engine Software 17.9.3a; Cisco UTD SNORT IPS Engine Software 17.12.1a; Cisco UTD SNORT IPS Engine Software 17.9.4; Cisco UTD SNORT IPS Engine Software 17.6.6; Cisco UTD SNORT IPS Engine Software 17.3.8; Cisco UTD SNORT IPS Engine Software 17.3.8a; Cisco UTD SNORT IPS Engine Software 17.6.6a; Cisco UTD SNORT IPS Engine Software 17.9.4a; Cisco UTD SNORT IPS Engine Software 17.12.2; Cisco UTD SNORT IPS Engine Software 17.13.1a; Cisco UTD SNORT IPS Engine Software 17.9.5a; Cisco UTD SNORT IPS Engine Software 17.12.3; Cisco UTD SNORT IPS Engine Software 17.6.7; Cisco UTD SNORT IPS Engine Software 17.14.1a; Cisco UTD SNORT IPS Engine Software 17.12.4; Cisco UTD SNORT IPS Engine Software 17.12.3a; Cisco UTD SNORT IPS Engine Software 17.15.1a; Cisco UTD SNORT IPS Engine Software 17.6.8; Cisco UTD SNORT IPS Engine Software 17.9.6; Cisco UTD SNORT IPS Engine Software 17.6.8a; Cisco UTD SNORT IPS Engine Software 17.16.1a; Cisco UTD SNORT IPS Engine Software 17.9.5e; Cisco UTD SNORT IPS Engine Software 17.12.4a; Cisco UTD SNORT IPS Engine Software 17.15.2c; Cisco UTD SNORT IPS Engine Software 17.9.5f; Cisco UTD SNORT IPS Engine Software 17.12.4b; Cisco UTD SNORT IPS Engine Software 17.15.2a; Cisco UTD SNORT IPS Engine Software 17.12.5; Cisco UTD SNORT IPS Engine Software 17.17.1; Cisco UTD SNORT IPS Engine Software 17.12.5a; Cisco UTD SNORT IPS Engine Software 17.9.7a; Cisco UTD SNORT IPS Engine Software 17.15.3a; Cisco UTD SNORT IPS Engine Software 17.15.3; Cisco UTD SNORT IPS Engine Software 17.12.5b; Cisco UTD SNORT IPS Engine Software 17.12.5c; Cisco UTD SNORT IPS Engine Software 17.15.4; Cisco UTD SNORT IPS Engine Software 17.9.7b; Cisco UTD SNORT IPS Engine Software 17.18.1; Cisco UTD SNORT IPS Engine Software 17.18.1a; Cisco UTD SNORT IPS Engine Software 17.12.6; Cisco UTD SNORT IPS Engine Software 17.9.8; Cisco UTD SNORT IPS Engine Software 17.15.4c; Cisco UTD SNORT IPS Engine Software 17.12.5d; Cisco UTD SNORT IPS Engine Software 17.18.2 |
| Fixed in | Same patched build as CVE-2026-20005 |
| Type (CWE) | CWE-248: Uncaught Exception |
Exploitation status
CVE-2026-20068 has not (yet) been flagged on the CISA Known Exploited Vulnerabilities catalog; treat that as 'no confirmed exploitation on record', not 'safe to ignore'. Do not read that as all-clear: the KEV catalog often trails real-world attacks, so prioritise this on its severity rather than waiting for a listing.
Public exploit availability: no public proof-of-concept or Metasploit module is referenced in this record yet. That says nothing about private exploit code, so do not treat the issue as low risk just because none is published.
Authoritative references:
What's different about CVE-2026-20068?
Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.
This vulnerability is due to incomplete error checking when parsing remote procedure call (RPC) data. An attacker could exploit this vulnerability by sending crafted RPC packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.
Resolve
Apply the patched build per the primary write-up: How to Fix CVE-2026-20005. All commands, verification steps, and rollback notes for Cisco Cyber Vision are listed there.
Frequently asked questions
Does the CVE-2026-20005 patch close CVE-2026-20068?
Yes. Both CVEs are addressed by the same vendor patch. Applying the patched build closes the full bundle.
Is CVE-2026-20068 listed in CISA KEV?
No public KEV listing at the time of this writing.
Where is the official advisory?
See https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-multi-dos-XFWkWSwz
References
- Official vendor advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-multi-dos-XFWkWSwz
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20068
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Primary: How to Fix CVE-2026-20005
*Written by Sai Kiran Pandrala. Part of the Cisco Cyber Vision bundle. Full procedure at how-to-fix-cve-2026-20005.*
Related fixes
Related guides worth a look while you sort this one out:
- How to Fix CVE-2026-20062: Incorrect execution-assigned permissions in Cisco Secure Firewall Adaptive Security Appliance
- How to Fix CVE-2026-20063: Cisco Secure Firewall Threat Defense (FTD) Software (Bundle Sibling)
- How to Fix CVE-2026-20064: Cisco Secure Firewall Threat Defense (FTD) Software (Bundle Sibling)
- How to Fix CVE-2026-20065: Cisco Secure Firewall Threat Defense (FTD) Software (Bundle Sibling)
- How to Fix CVE-2026-20066: Cisco Secure Firewall Threat Defense (FTD) Software (Bundle Sibling)
- How to Fix CVE-2026-20067: Cisco Cyber Vision (Bundle Sibling)
People also ask
Does the CVE-2026-20005 patch close CVE-2026-20068?
Yes. Both CVEs are addressed by the same vendor patch. Applying the patched build closes the full bundle.
Is CVE-2026-20068 listed in CISA KEV?
No public KEV listing at the time of this writing.
Where is the official advisory?
See https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-multi-dos-XFWkWSwz