Cisco has issued a security warning about high-severity ClamAV flaws affecting its Secure Endpoint Connector products on Windows, macOS, and Linux. According to Cisco, the issues include multiple defects in ClamAV file parsers that could trigger denial-of-service (DoS) conditions, with two vulnerabilities accompanied by publicly available proof-of-concept (PoC) code.
ClamAV—short for Clam AntiVirus—is an open source, cross-platform malware detection engine. It is designed to scan files and support features such as multi-threaded scanning, email filtering, and automatic updates to its detection databases.
What vulnerabilities are involved
Cisco says the reported security defects are tracked under the following CVE identifiers: CVE-2026-20337 to CVE-2026-20339 and CVE-2026-20345 to CVE-2026-20348. The problems were found in ClamAV parsers for several common file formats, including ZIP, GPT, PESpin, PDF, Mach-O, and XAR.
In practical terms, parsing vulnerabilities can be especially impactful for antivirus and scanning components, since these services routinely process untrusted files. Cisco’s advisory highlights that this risk profile varies by operating system due to differences in how the scanning process is executed.
Public PoC code for two issues
Cisco notes that after the ClamAV project released fixes, it published an additional advisory stating that PoC code exists for targeted vulnerabilities. Cisco specifically references PoC availability for CVE-2026-20337 and CVE-2026-20338.
Public PoC code does not automatically mean attacks are widespread, but it can lower the barrier for experimentation and help validate that the vulnerabilities behave as described.
Impact by platform: high vs. medium severity
Cisco attributes a higher risk level on Windows to how ClamAV runs. Cisco states that on Windows, the platforms execute the ClamAV scanning process in a privileged security context. Because of that elevated context, the vulnerabilities are considered high-severity there.
On macOS and Linux, Cisco categorizes the issues as medium-severity. The reason is that on those platforms, the ClamAV scanning process runs with lower privileges compared with Windows, reducing the potential impact of a successful exploitation path.
What changed in ClamAV 1.5.4
Cisco indicates that patches for these vulnerabilities were included in ClamAV version 1.5.4. Cisco also points out that the ClamAV 1.5.4 release contains an additional fix: a patch for a path traversal weakness in WinRAR on Windows that could lead to arbitrary code execution.
Even though the Cisco advisory focuses on the Secure Endpoint Connector integration, it’s important for customers to treat the ClamAV component update as the core remediation path.
No workarounds and scheduled updates
Cisco reports that it is not aware of any of these vulnerabilities being actively exploited in the wild. However, the company also states that no workaround exists for any of the issues.
Instead, Cisco says customers should plan for security updates to be rolled out in August for all Secure Endpoint Connector products. Until then, timely patch management and controlled exposure of scanning workflows remain important.
Which Cisco products are affected
Not every part of Cisco’s Secure Endpoint portfolio is impacted. Cisco clarifies that Secure Endpoint Private Cloud is not affected.
The concern is specifically with the Secure Endpoint Connector software. Cisco advises customers to push the available patches—which are included in Secure Endpoint Private Cloud releases 4.2.8 and later—from the cloud environment to their endpoints.
For organizations using a private cloud release train, this guidance effectively ties remediation to the ability to propagate updates through their normal management workflow.
Why file parsing bugs matter for security tools
Vulnerabilities in parsers for popular document and archive formats can be high-risk because these tools frequently inspect content that attackers intentionally craft to trigger edge cases. In antivirus workflows, the scanning engine may be designed to process many types of inputs quickly and at scale, which increases the chance that malformed files reach vulnerable code paths.
That helps explain why Cisco’s advisory focuses on scanner privileges and execution context. When a scanning process runs with higher privileges, the consequences of a successful exploitation attempt can be more severe.
Recommended next steps
If your environment includes Cisco Secure Endpoint Connector on Windows, macOS, or Linux, Cisco’s advisory suggests you focus on the following actions:
- Plan patching for August and align internal change windows with Cisco’s update schedule.
- Ensure you are on ClamAV 1.5.4 (or the equivalent fixed state provided through Cisco updates).
- Validate update propagation from Secure Endpoint Private Cloud—patches are included in 4.2.8 and later.
- Monitor vulnerability communications from your vendor and maintain an inventory of affected connector instances.
Because Cisco states that no workaround exists, the most practical mitigation is to accelerate patch availability and ensure deployments actually reach endpoints.
Bottom line
Cisco’s warning centers on high-severity ClamAV flaws that can lead to denial-of-service conditions, with two issues tied to publicly available PoC code. While Cisco has not seen evidence of real-world exploitation, the absence of workarounds makes patching the critical move—especially for Windows users where the scanning process runs with elevated privileges.
By pushing the available fixes through Secure Endpoint Private Cloud releases 4.2.8 and later and preparing for the August rollout, organizations can reduce the risk posed by these parser vulnerabilities across Windows, macOS, and Linux endpoints.
Source: https://www.securityweek.com/cisco-warns-of-high-severity-clamav-vulnerabilities-with-public-poc/
