Cisco warns of ClamAV flaws with public exploit code and no workaround

Cisco warned that public proof-of-concept code exists for two vulnerabilities in ClamAV, the widely used open-source antivirus engine, that a remote unauthenticated attacker can use to crash the scanning process and disrupt protection. Tracked as CVE-2026-20337 and CVE-2026-20338, the flaws are rated high severity on Windows because ClamAV runs there in a privileged security context, and medium on macOS and Linux where it runs with lower privileges. There are no workarounds, and Cisco is rolling out fixes in August across its Secure Endpoint Connector products, which embed ClamAV. Because ClamAV is bundled into many mail and file-scanning products, exposure extends well beyond Cisco.

Check

Update ClamAV and any products that embed it, including Cisco Secure Endpoint Connector, and prioritize Windows systems where the scanning process runs in a privileged context.

Affected

Systems running unpatched ClamAV or products that bundle it (CVE-2026-20337, CVE-2026-20338); a remote attacker can crash scanning to disable protection, with the highest risk on Windows and public exploit code available.

Fix

Apply the ClamAV updates as they ship, since there is no workaround, inventory the mail and file-scanning products that embed the engine, and monitor for scanning processes crashing unexpectedly.