Cisco warns of high-severity ClamAV flaws with public exploits
Source Bleeping Computer
Mentioned vulnerabilities
Fixed in 1.5.4 : patch affected systems soon.
Data as of 11 Aug 2026, 11:11 UTC
Rated High by Bleeping Computer
- Patch
- Available – fixed in 1.5.4
What to do
AI-suggested
These vulnerabilities were patched in ClamAV version 1.5.4 released on August 7, 2026. Cisco plans to release Secure Endpoint Connector updates for Windows, Linux, and Mac later in the month to address these flaws. There are no workarounds for these issues. Organizations should apply the ClamAV 1.5.4 update promptly and monitor Cisco advisories for the forthcoming Secure Endpoint Connector patches. Patch status is confirmed by Cisco's advisory.
Description
Cisco has disclosed two high-severity vulnerabilities in the ClamAV scanning engine used by its Secure Endpoint Connector. These flaws allow unauthenticated remote attackers to crash the ClamAV scanning process by submitting specially crafted ZIP files, causing denial-of-service (DoS) conditions. The vulnerabilities affect ClamAV versions 1.5.0 through 1.5.3 and were patched in version 1.5.4. The impact is particularly significant on Windows platforms where ClamAV runs with privileged security context. Proof-of-concept exploit code is publicly available, but there is no evidence of active exploitation in the wild. Cisco plans to release updates for affected Secure Endpoint Connector versions across Windows, Linux, and Mac platforms. No workarounds exist for these vulnerabilities.