Cisco warns of high-severity ClamAV flaws with public exploits

Cisco has issued an advisory for two high-severity denial-of-service vulnerabilities in the Secure Endpoint Connector, driven by flaws in the underlying ClamAV engine. The issues, tracked as CVE-2026-20337 and CVE-2026-20338, stem from improper boundary checks and memory handling in the ZIP archive parser, allowing unauthenticated remote attackers to crash the scanning process using crafted files. While proof-of-concept exploit code is already available, Cisco reports no evidence of active exploitation in the wild.

The vulnerabilities affect ClamAV versions 1.5.0 through 1.5.3, primarily impacting Windows systems where the service runs with elevated privileges. Fixes are included in ClamAV version 1.5.4, and Cisco plans to distribute updated connector software for Windows, Linux, and macOS later this month.