Reported by 4 outlets

Timeline

1. original reporting

   Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC

   securityweek.com · 64d ago · August 10th, 2026

2. update from cyberpress.org

   Cisco ClamAV Memory Corruption Bugs Let Remote Attackers Crash Secure Endpoint Scanning

   cyberpress.org · 64d ago · August 11th, 2026

   Cisco disclosed multiple ClamAV memory-corruption vulnerabilities — CVE-2026-20337, CVE-2026-20338, CVE-2026-20339, and CVE-2026-20345 — that let unauthenticated remote attackers terminate the ClamAV scanning process on affected Secure Endpoint Connector installations (advisory cisco-sa-clamav-WuuvVd26). Windows connectors carry a High impact rating and CVSS 7.5 because the scanning process runs in a privileged context; Linux and macOS connectors received Medium ratings. SecurityWeek notes public proof-of-concept code is available, so patch the connector fleet promptly.

3. update from gbhackers.com

   CiscoClamAV Vulnerabilities Let Remote Attackers Crash Antivirus Scanning With Crafted Files

   gbhackers.com · 63d ago · August 11th, 2026

   Cisco has disclosed seven high-severity vulnerabilities in ClamAV that could allow unauthenticated remote attackers to disrupt antivirus scanning by submitting specially crafted files. These vulnerabilities are tracked as CVE-2026-20337, CVE-2026-20338, CVE-2026-20339, CVE-2026-20345, CVE-2026-20346, CVE-2026-20347, and CVE-2026-20348, and have been assigned a maximum CVSS score of 7.5. ClamAV Vulnerabilities The issues are detailed in the Cisco […] The post CiscoClamAV Vulnerabilities Let Remote Attackers Crash Antivirus Scanning With Crafted Files appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. update from cyberpress.org

   ClamAV Memory Corruption Bugs Expose Cisco Secure Endpoint to Remote DoS Attacks

   cyberpress.org · 63d ago · August 11th, 2026

   The flaws, disclosed in advisory cisco-sa-clamav-WuuvVd26, affect Windows, Linux, and macOS endpoints that use the ClamAV engine to inspect files. Successful exploitation can terminate the ClamAV scanning process. The higher Windows rating reflects the privileged context in which the scanning process executes. ClamAV Memory Corruption Bugs Linux and macOS connectors received Medium ratings because their scanning processes run with lower privileges. Risk remains material across platforms. Attackers need not authenticate or persuade a user to open a file to exploit the affected parser. A malicious object only needs to reach a path monitored by the connector, such as email delivery, downloads, shared storage, web transfers, or automated file ingestion. CVE-2026-20337 is an out-of-bounds write in the ZIP archive parser, caused by insufficient boundary checks while ClamAV processes archive content. CVE-2026-20338, also in ZIP handling, results from improper memory management that may trigger a double-free condition. Cisco said proof-of-concept exploit code is available for both vulnerabilities, requiring rapid patch deployment. CVE-2026-20339 targets PESpin file processing and arises fro

5. update from bleepingcomputer.com

   Cisco warns of high-severity ClamAV flaws with public exploits

   bleepingcomputer.com · 63d ago · August 11th, 2026

   Cisco warned of two high-severity vulnerabilities affecting the Secure Endpoint Connector that allow threat actors to crash the ClamAV scanning process in denial-of-service (DoS) attacks. The company's Product Security Incident Response Team (PSIRT) added that proof-of-concept (PoC) exploit code is already publicly available, but said that it has no evidence the flaws have been exploited in the wild.