Open Source Snort 3 Command Execution

Snort 3

Authenticated local attacker can execute arbitrary commands as the Snort 3 process user.

Do this now

Apply the available Snort 3 fix and restrict local shell access to Snort 3 hosts.

Still cooking for Cisco Open Source Snort3.

First seen: 21 Oct 2026
Last update: 21 Oct 2026, 16:00 UTC
Identifiers: CVE-2026-76524
CVSS: 7.8
Source: news
On the menu as: Security tools

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Open Source Snort 3 Command Execution
Severity: high. Patch status: patched.
Affected: Snort 3
Ids: CVE-2026-76524

Authenticated local attacker can execute arbitrary commands as the Snort 3 process user.

## Steps
1. Search the repo, its CI and infra config for Snort 3. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-76524") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-opensrc-snort3-2fXGJPfe?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Open%20Source%20Snort%203%20Control%20Channel%20Socket%20Arbitrary%20Command%20Execution%20Vulnerability%26vs_k=1
https://pwned.coffee/i/open-source-snort-3-command-execution-cve-2026-76524

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Cisco Open Source Snort3 3.12.1.0 to now no fix on 3.12.x yet CVE record (CNA)
Cisco Open Source Snort3 = 3.11.1.0 no fix on 3.11.x yet CVE record (CNA)
Cisco Open Source Snort3 3.10.0.0 to now no fix on 3.10.x yet CVE record (CNA)
Cisco Open Source Snort3 3.9.0.0 to now no fix on 3.9.x yet CVE record (CNA)
Cisco Open Source Snort3 = 3.8.1.0 no fix on 3.8.x yet CVE record (CNA)
Cisco Open Source Snort3 3.7.0.0 to now no fix on 3.7.x yet CVE record (CNA)
Cisco Open Source Snort3 3.6.0.0 to now no fix on 3.6.x yet CVE record (CNA)
Cisco Open Source Snort3 3.5.0.0 to now no fix on 3.5.x yet CVE record (CNA)
Cisco Open Source Snort3 3.3.0.0 to now no fix on 3.3.x yet CVE record (CNA)
Cisco Open Source Snort3 3.2.1.0 to now no fix on 3.2.x yet CVE record (CNA)
Cisco Open Source Snort3 3.1.2.0 to now no fix on 3.1.x yet CVE record (CNA)
Score: CVSS 7.8 (high). CVSS 3.1 7.8 (CNA cisco) for CVE-2026-76524
Last checked: 24 Oct 2026, 18:17 UTC

Product	Affected	Fixed in	Source
Cisco Open Source Snort3	3.12.1.0 to now	no fix on 3.12.x yet	CVE record (CNA)
Cisco Open Source Snort3	= 3.11.1.0	no fix on 3.11.x yet	CVE record (CNA)
Cisco Open Source Snort3	3.10.0.0 to now	no fix on 3.10.x yet	CVE record (CNA)
Cisco Open Source Snort3	3.9.0.0 to now	no fix on 3.9.x yet	CVE record (CNA)
Cisco Open Source Snort3	= 3.8.1.0	no fix on 3.8.x yet	CVE record (CNA)
Cisco Open Source Snort3	3.7.0.0 to now	no fix on 3.7.x yet	CVE record (CNA)
Cisco Open Source Snort3	3.6.0.0 to now	no fix on 3.6.x yet	CVE record (CNA)
Cisco Open Source Snort3	3.5.0.0 to now	no fix on 3.5.x yet	CVE record (CNA)
Cisco Open Source Snort3	3.3.0.0 to now	no fix on 3.3.x yet	CVE record (CNA)
Cisco Open Source Snort3	3.2.1.0 to now	no fix on 3.2.x yet	CVE record (CNA)
Cisco Open Source Snort3	3.1.2.0 to now	no fix on 3.1.x yet	CVE record (CNA)

Sources: KEV – CVE record ✓ Vendor ✓

Sources

sec.cloudapps.cisco.com: Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability

Totalone hot coffee