Cisco warned of two high-severity vulnerabilities affecting the Secure Endpoint Connector that allow threat actors to crash the ClamAV scanning process in denial-of-service (DoS) attacks.
The security flaws (tracked as CVE-2026-20337 and CVE-2026-20338) were found in the ZIP archive parser of ClamAV (Clam AntiVirus), the open-source and cross-platform engine used to scan files for malware.
As Cisco explained in a Friday advisory, the two vulnerabilities are due to improper boundary checks and memory handling, respectively, and can be exploited by unauthenticated, remote attackers.
The company’s Product Security Incident Response Team (PSIRT) added that proof-of-concept (PoC) exploit code is already publicly available, but said that it has no evidence the flaws have been exploited in the wild.
“An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software,” it said. “The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in CVE-2026-20337 and CVE-2026-20338.”
Cisco added that the flaws’ security impact is high only for Windows platforms since they’re the only ones that “run the ClamAV scanning process in a privileged security context.”
These two vulnerabilities affect ClamAV 1.5.0 through 1.5.3, and they were patched in version 1.5.4 released on August 7.
While there are no workarounds for CVE-2026-20337 and CVE-2026-20338, the company plans to release software updates later this month to address them in affected versions of Secure Endpoint Connector for Windows, Linux, and Mac.
On Friday, Cisco patched five other ClamAV security flaws that can also be exploited to trigger denial-of-service conditions by submitting malicious XAR, Mach-O, PDF, GPT, and PESpin files for scanning.
It patched another ClamAV DoS vulnerability with PoC exploit code in January 2025, warning that attackers could abuse it to terminate the ClamAV antivirus scanner, preventing or delaying further scanning operations.
Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has tagged 95 Cisco vulnerabilities as actively exploited in attacks, six of them abused in ransomware attacks.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
vBulletin fixes critical pre-auth RCE flaw with public exploit
Critical SharePoint RCE flaw exploited to steal machine keys
HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload
FFmpeg fixes PixelSmash flaw in widely used video decoder
F5 issues out-of-band patches for critical NGINX vulnerabilities
Hackers breach TrueConf to trojanize client installers with backdoors
LexisNexis shuts down services after suspicious activity on servers
Valve notifies Steam hardware customers of a data breach
AI is a data-breach time bomb: Read the new report
Overdue a password health-check? Audit your Active Directory for free
Webinar: Shadow AI in 2026 (and how attackers are taking advantage)
See how Skyhigh Security’s patent-pending approach secures every browser session without costly and clunky enterprise browser replacements.
See how real inboxes, fake stores and AI scams shaped H1 2026 cyber threats
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
