Cisco warns of high-severity ClamAV flaws with public exploits
Cisco warns of two high-severity ClamAV flaws with public exploits leading to DoS.
Summary
Cisco has alerted users to two critical vulnerabilities in the ClamAV scanning engine, CVE-2026-20337 and CVE-2026-20338, which can be exploited by remote attackers to cause denial-of-service conditions. Proof-of-concept exploit code is publicly available, though Cisco has not seen evidence of in-the-wild exploitation. The vulnerabilities affect ClamAV versions 1.5.0 through 1.5.3 and have been patched in version 1.5.4.
Full text
Cisco warns of high-severity ClamAV flaws with public exploits By Sergiu Gatlan August 11, 2026 07:03 AM 0 Cisco warned of two high-severity vulnerabilities affecting the Secure Endpoint Connector that allow threat actors to crash the ClamAV scanning process in denial-of-service (DoS) attacks. The security flaws (tracked as CVE-2026-20337 and CVE-2026-20338) were found in the ZIP archive parser of ClamAV (Clam AntiVirus), the open-source and cross-platform engine used to scan files for malware. As Cisco explained in a Friday advisory, the two vulnerabilities are due to improper boundary checks and memory handling, respectively, and can be exploited by unauthenticated, remote attackers. The company's Product Security Incident Response Team (PSIRT) added that proof-of-concept (PoC) exploit code is already publicly available, but said that it has no evidence the flaws have been exploited in the wild. "An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software," it said. "The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in CVE-2026-20337 and CVE-2026-20338." Cisco added that the flaws' security impact is high only for Windows platforms since they're the only ones that "run the ClamAV scanning process in a privileged security context." These two vulnerabilities affect ClamAV 1.5.0 through 1.5.3, and they were patched in version 1.5.4 released on August 7. While there are no workarounds for CVE-2026-20337 and CVE-2026-20338, the company plans to release software updates later this month to address them in affected versions of Secure Endpoint Connector for Windows, Linux, and Mac. On Friday, Cisco patched five other ClamAV security flaws that can also be exploited to trigger denial-of-service conditions by submitting malicious XAR, Mach-O, PDF, GPT, and PESpin files for scanning. It patched another ClamAV DoS vulnerability with PoC exploit code in January 2025, warning that attackers could abuse it to terminate the ClamAV antivirus scanner, preventing or delaying further scanning operations. Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has tagged 95 Cisco vulnerabilities as actively exploited in attacks, six of them abused in ransomware attacks. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: vBulletin fixes critical pre-auth RCE flaw with public exploitCritical SharePoint RCE flaw exploited to steal machine keysHollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payloadFFmpeg fixes PixelSmash flaw in widely used video decoderF5 issues out-of-band patches for critical NGINX vulnerabilities
Indicators of Compromise
- cve — CVE-2026-20337
- cve — CVE-2026-20338