CVE-2026-76524
Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability
Description
A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.
Weakness: CWE-306
Affected products
| Vendor | Product | Category | Matched by |
|---|
No product mapping yet — this CVE is pending taxonomy review.
Vendor-reported products (1)
- Cisco · Cisco Open Source Snort3
Vendor advisory
cisco-sa-opensrc-snort3-2fXGJPfe
Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability
Cisco’s rating: High (advisory CVSS 7.8) · Published Oct 21, 2026
Bug ID: CSCwv48789
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from