Cisco warned of two high-severity vulnerabilities affecting the Secure Endpoint Connector that allow threat actors to crash the ClamAV scanning process in denial-of-service (DoS) attacks.
The security flaws (tracked as CVE-2026-20337 and CVE-2026-20338) were found in the ZIP archive parser of ClamAV (Clam AntiVirus), the open-source and cross-platform engine used to scan files for malware.
As Cisco explained in a Friday advisory, the two vulnerabilities are due to improper boundary checks and memory handling, respectively, and can be exploited by unauthenticated, remote attackers.
The company’s Product Security Incident Response Team (PSIRT) added that proof-of-concept (PoC) exploit code is already publicly available, but said that it has no evidence the flaws have been exploited in the wild.
“An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software,” it said. “The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in CVE-2026-20337 and CVE-2026-20338.”
Cisco added that the flaws’ security impact is high only for Windows platforms since they’re the only ones that “run the ClamAV scanning process in a privileged security context.”
These two vulnerabilities affect ClamAV 1.5.0 through 1.5.3, and they were patched in version 1.5.4 released on August 7.
While there are no workarounds for CVE-2026-20337 and CVE-2026-20338, the company plans to release software updates later this month to address them in affected versions of Secure Endpoint Connector for Windows, Linux, and Mac.
On Friday, Cisco patched five other ClamAV security flaws that can also be exploited to trigger denial-of-service conditions by submitting malicious XAR, Mach-O, PDF, GPT, and PESpin files for scanning.
It patched another ClamAV DoS vulnerability with PoC exploit code in January 2025, warning that attackers could abuse it to terminate the ClamAV antivirus scanner, preventing or delaying further scanning operations.
Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has tagged 95 Cisco vulnerabilities as actively exploited in attacks, six of them abused in ransomware attacks.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
