Two high-severity vulnerabilities (CVE-2026-20337 and CVE-2026-20338) were found in the ZIP archive parser of ClamAV, an open-source antivirus engine used by Cisco Secure Endpoint Connector. The flaws stem from improper boundary checks and memory handling, enabling unauthenticated remote attackers to submit crafted ZIP files that crash the ClamAV scanning process, resulting in denial-of-service. These vulnerabilities affect ClamAV versions 1.5.0 through 1.5.3 and were fixed in version 1.5.4 released on August 7, 2026. Cisco highlighted that the security impact is highest on Windows due to privileged execution context. Proof-of-concept exploit code is publicly available, but no active exploitation has been observed. Cisco is preparing updates for Secure Endpoint Connector on multiple platforms to address these issues. No workarounds are available.

Successful exploitation causes the ClamAV scanning process to terminate, resulting in denial-of-service conditions on affected systems. On Windows platforms, where ClamAV runs with elevated privileges, the impact is considered high. The vulnerabilities do not provide code execution or data compromise but disrupt malware scanning capabilities, potentially allowing malware to evade detection temporarily. There is no evidence of exploitation in the wild despite public availability of proof-of-concept code.

These vulnerabilities were patched in ClamAV version 1.5.4 released on August 7, 2026. Cisco plans to release Secure Endpoint Connector updates for Windows, Linux, and Mac later in the month to address these flaws. There are no workarounds for these issues. Organizations should apply the ClamAV 1.5.4 update promptly and monitor Cisco advisories for the forthcoming Secure Endpoint Connector patches. Patch status is confirmed by Cisco's advisory.