read the 9.0 on ciscos snort 3 hardening release carefully. each CVE is a bucket: cisco grouped a batch of internally found bugs by CWE, gave each group one id, and scored it by its worst member. individual bug details arent public CVE-2026-20043 is the out-of-bounds write bucket, 9.0 at AV:N/AC:H/PR:N/S:C. ciscos table also puts CVE-2026-20236 (incorrect calculation) at 9.0, but the cisco vector on its NVD record is 7.5 DoS only, so treat that one as unresolved. 20291 (privilege mgmt, 7.8) and 20356 (resource consumption, 7.5) round it out cisco says they were found "using existing testing processes as well as frontier AI models." no known exploitation, no workarounds affects the snort 3 engine in FTD, UTD on IOS XE, meraki MX, cyber vision, cloud-delivered firewall and secure access, regardless of config. snort 2 isnt affected. cloud firewall, secure access and online meraki MX were updated by cisco. FTD, IOS XE UTD, cyber vision and self-run snort 3 (fixed in 3.12.4.0) are on u https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe