Cisco disclosed seven vulnerabilities in ClamAV, tracked as CVE-2026-20337 to CVE-2026-20339 and CVE-2026-20345 to CVE-2026-20348, affecting its Secure Endpoint Connector on Windows, macOS, and Linux. These flaws reside in ClamAV's file format parsers for ZIP, GPT, PESpin, PDF, Mach-O, and XAR, enabling remote unauthenticated attackers to trigger denial-of-service conditions. Two vulnerabilities have public proof-of-concept code available. ClamAV version 1.5.4 includes patches for these issues, alongside a fix for a related WinRAR path traversal vulnerability. Cisco plans to distribute security updates for its Secure Endpoint Connector products in August. The vulnerabilities pose a high risk on Windows due to privileged scanning processes, and medium risk on macOS and Linux where scanning runs with lower privileges. Secure Endpoint Private Cloud is unaffected. No known active exploitation has been reported.

The vulnerabilities allow remote, unauthenticated attackers to cause denial-of-service conditions on affected systems running Cisco Secure Endpoint Connector with ClamAV. On Windows, the impact is higher severity because the scanning process runs with elevated privileges, potentially causing more significant disruption. On macOS and Linux, the impact is medium severity due to lower privilege execution of the scanning process. There is no indication of code execution or data compromise from these vulnerabilities. No active exploitation in the wild has been observed.

Patches addressing these vulnerabilities are available in ClamAV version 1.5.4 and will be rolled out by Cisco for Secure Endpoint Connector products in August. Customers should apply these updates promptly once released. No workarounds exist for these vulnerabilities. Secure Endpoint Private Cloud customers should ensure they are running release 4.2.8 or later, which includes the fixes. Cisco advises pushing the available patches from the cloud to endpoints. Monitoring or other mitigations are not specifically recommended by Cisco.