In brief: Cisco warns of seven ClamAV vulnerabilities in its Secure Endpoint Connector products, public exploit code is already available for two of them, and security updates without workarounds are not expected to appear until August.
Cisco reports seven ClamAV vulnerabilities in its Secure Endpoint Connector products. Exploit code for two of them is already publicly available, while patches are not expected to be released until sometime in August.
The open-source malware detection engine ClamAV, which offers a multi-threaded virtual scanner, email filtering, and automatic database updates, among other features, is affected by seven vulnerabilities. They carry the identifiers CVE-2026-20337 through CVE-2026-20339 as well as CVE-2026-20345 through CVE-2026-20348 and reside in the ClamAV parsers for the ZIP, GPT, PESpin, PDF, Mach-O, and XAR file formats. An unauthenticated, remote attacker could exploit them to trigger a denial of service. The flaws are fixed in ClamAV version 1.5.4, which also closes a path traversal vulnerability in WinRAR for Windows that could have been used to execute arbitrary code.
Shortly after these fixes were published, Cisco issued its own security advisory warning of already existing exploit code for CVE-2026-20337 and CVE-2026-20338. No workarounds are available for any of the vulnerabilities. For CISOs, this means an immediate risk assessment with no option for temporary mitigation — according to Cisco, patches for all Secure Endpoint Connector products are not expected to be provided until sometime in August.
According to Cisco’s assessment, the vulnerabilities pose a high risk for Windows users, since the ClamAV scanning process runs in a privileged security context on that platform. On macOS and Linux, the risk is rated medium, as the scanning process operates there with lower privileges. The cloud variant Secure Endpoint Private Cloud itself is not affected, though the associated Secure Endpoint Connector software is.
Customers are advised to roll out the already available patches in Secure Endpoint Private Cloud versions 4.2.8 and newer from the cloud to endpoint devices. Cisco stated that it currently has no indications of active exploitation of the vulnerabilities in the wild — given the publicly available exploit code for two of the flaws, rolling out the patches should be prioritized as soon as they become available.
Source: www.it-daily.net · Published August 13, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.