Cisco warns of 7 ClamAV flaws impacting Secure Endpoint Connector

Cisco has issued a warning regarding seven vulnerabilities discovered in the ClamAV antivirus engine, which affect its Secure Endpoint Connector products for Windows, macOS, and Linux. Two of these flaws have publicly available proof-of-concept exploits that could allow unauthenticated attackers to trigger denial-of-service conditions, according to a recent report by Security Affairs.

The vulnerabilities, identified as CVE-2026-20337 through CVE-2026-20339 and CVE-2026-20345 to CVE-2026-20348, impact ClamAV's parsers for various file formats. Specifically, CVE-2026-20337 and CVE-2026-20338, both with a CVSS score of 7.5, relate to vulnerabilities in the zip archive parser. These could allow remote attackers to cause out-of-bounds writes or memory corruption, leading to the termination of ClamAV scanning operations. Cisco has stated that while there is no evidence of these vulnerabilities being exploited in the wild, patches are expected in August.

The risk is considered high for Windows due to ClamAV running with elevated privileges, while macOS and Linux face a medium risk. No workarounds are currently available for these issues.

Source: Security Affairs