cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Cisco Warns of Seven ClamAV Flaws Affecting Secure Endpoint; Two Have Public PoCs

· Original article ↗

Summary

Cisco says seven ClamAV vulnerabilities affect Secure Endpoint Connector products on Windows, macOS, and Linux; two have public PoC code. ClamAV 1.5.4 includes fixes, and Cisco says it has no evidence of in-the-wild exploitation.

Key points

  • The seven flaws, CVE-2026-20337 through CVE-2026-20339 and CVE-2026-20345 through CVE-2026-20348, affect ClamAV parsers for ZIP, GPT, PESpin, PDF, Mach-O, and XAR files.
  • The vulnerabilities could cause denial of service; public PoC code exists for CVE-2026-20337 and CVE-2026-20338.
  • Cisco says the flaws affect Secure Endpoint Connector products on Windows, macOS, and Linux, but not Secure Endpoint Private Cloud.
  • ClamAV 1.5.4 includes fixes for the vulnerabilities. Cisco says no workaround is available and security updates will be rolled out in August.
  • Cisco rates the risk as high on Windows, where ClamAV runs with elevated privileges, and medium on macOS and Linux, where it runs with lower privileges.
  • Cisco says it is not aware of exploitation in the wild; customers are advised to push available patches to endpoints.

Article Details

Vulnerability Types
  • Denial-of-service vulnerabilities in file-format parsers
Severity
High for Windows; medium for macOS and Linux, according to Cisco.
Exploitation Status
not_reported
Exploit Availability
public_poc
Patch Status
available

CVE

CVE-2026-20337Vendor / Product unavailableThe security defects, tracked as CVE-2026-20337 to CVE-2026-20339 and CVE-2026-20345 to CVE-2026-20348, were discovered in ClamAV’s parsers for ZIP, GPT, PESpin, PDF, Mach-O, and XAR file formats.CVE-2026-20338Vendor / Product unavailableShortly after ClamAV rolled out the fixes, Cisco published an advisory warning that PoC code targeting CVE-2026-20337 and CVE-2026-20338 exists.CVE-2026-20339Vendor / Product unavailableThe security defects, tracked as CVE-2026-20337 to CVE-2026-20339 and CVE-2026-20345 to CVE-2026-20348, were discovered in ClamAV’s parsers for ZIP, GPT, PESpin, PDF, Mach-O, and XAR file formats.CVE-2026-20345Vendor / Product unavailableThe security defects, tracked as CVE-2026-20337 to CVE-2026-20339 and CVE-2026-20345 to CVE-2026-20348, were discovered in ClamAV’s parsers for ZIP, GPT, PESpin, PDF, Mach-O, and XAR file formats.CVE-2026-20348Cisco · Secure endpointThe security defects, tracked as CVE-2026-20337 to CVE-2026-20339 and CVE-2026-20345 to CVE-2026-20348, were discovered in ClamAV’s parsers for ZIP, GPT, PESpin, PDF, Mach-O, and XAR file formats.

Vendors

CiscoCisco on Friday warned that its Secure Endpoint Connector products on Windows, macOS, and Linux are affected by seven ClamAV vulnerabilities that could lead to denial-of-service (DoS) conditions, including two with

Products

ClamAVwarned that its Secure Endpoint Connector products on Windows, macOS, and Linux are affected by seven ClamAV vulnerabilities that could lead to denial-of-service (DoS) conditions, including two with publicSecure Endpoint ConnectorCisco on Friday warned that its Secure Endpoint Connector products on Windows, macOS, and Linux are affected by seven ClamAV vulnerabilities that could lead to denial-of-service (DoS) conditions, including two withSecure Endpoint Private CloudSecure Endpoint Private Cloud is not affected, but the Secure Endpoint Connector software is impacted, and customers are advised to push the available patches (included in Secure Endpoint Private Cloud releases 4.2.8

Related Articles