LIVE · cybersecurity feed
Live wire
CVE-2026-68820 · 17th August – Threat Intelligence ReportCVE-2026-69414 · ShieldBreak bypasses Microsoft’s patch for earlier Defender flawCVE-2026-15826 · WordPress Plugin Flaw Exposes 40,000 Sites to Admin TakeoverCVE-2026-58231 · Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After DisclosureBlack Hat and DEF CON are AI conferences now, tooAkira Ransomware Uses Safe Mode to Bypass EDRCVE-2026-58231 · Crooks Buy Expired Domains for Malware Delivery, Other Threats DetailedCVE-2026-58231 · SAP Commerce Cloud CVE-2026-58231 Exploited in the WildCVE-2026-65400 · macOS Screen Sharing Flaw Exploited to Deploy Monero MinersCVE-2026-46300 · Metasploit Wrap Up: Lot of summer shells and fit http profiles
vulnerability

Cisco Warns of Seven ClamAV Flaws, Two With Public PoCs

Cisco warns that seven ClamAV flaws affect Secure Endpoint Connector products, with two having public PoCs that could enable remote DoS attacks. Cisco warned that seven ClamAV vulnerabilities affect its Secure Endpoint Connector on Windows, macOS and Linux. ClamAV is an open-source antivirus engine widely used to scan files and emails for malware. The company […]

zeroday.news ·

Cisco has issued a warning regarding seven vulnerabilities discovered in ClamAV, an open-source antivirus engine, which affect its Secure Endpoint Connector products across Windows, macOS, and Linux platforms. Two of these flaws, identified as CVE-2026-20337 and CVE-2026-20338, have publicly available proof-of-concept (PoC) exploit code, raising concerns about potential denial-of-service (DoS) attacks.

ClamAV is widely deployed for scanning files and emails for malicious content. Cisco's advisory indicates that the vulnerabilities could allow an unauthenticated, remote attacker to trigger a DoS condition, thereby interrupting scanning operations. The company's Product Security Incident Response Team (PSIRT) has confirmed the existence of PoC exploits for CVE-2026-20337 and CVE-2026-20338 but states there is no evidence of these vulnerabilities being exploited in the wild.

The seven vulnerabilities, tracked with CVE IDs ranging from CVE-2026-20337 to CVE-2026-20339 and CVE-2026-20345 to CVE-2026-20348, primarily impact ClamAV parsers for various file formats. These issues have been addressed in ClamAV version 1.5.4.

Specifically, CVE-2026-20337, with a CVSS score of 7.5, is described as an out-of-bounds write vulnerability in ClamAV's zip archive parser. This flaw stems from inadequate boundary checks during the scanning of zip files. An attacker could exploit this by submitting a specially crafted zip file, leading to the termination of the ClamAV scanning process and a DoS condition.

CVE-2026-20338, also with a CVSS score of 7.5, is a memory corruption vulnerability, also within the zip archive parser. This vulnerability is attributed to improper memory handling when processing zip file content. A malicious zip file could cause a memory double-free, resulting in the ClamAV scanning process crashing and a DoS condition.

Cisco has identified its Secure Endpoint Connector for Windows, macOS, and Linux as affected products. The risk is considered high for Windows systems because ClamAV typically operates with elevated privileges on that platform, while macOS and Linux installations face a medium risk. Cisco Secure Endpoint Private Cloud is not directly affected, but customers must ensure that fixes are distributed to their endpoints.

While no workarounds are available, Cisco plans to release patches for the affected Secure Endpoint Connector products in August 2026. Customers are advised to consult the related bug IDs in Cisco's advisory for specific details on each vulnerability and the forthcoming fixes.

vulnerabilitymalwarecloud
ShareXLinkedInWhatsAppFacebook

More News

view all →
malware

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 110

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM ShieldBreak – August 2026 disclosure Kimwolf v7: An Evolution of the Kimwolf Botnet CISA, FBI and Partners Warn Organizations of […]

ddos

Large-scale DDoS attacks disrupted Threema secure messaging service

Multiple distributed denial-of-service (DDoS) attacks targeted the Threema secure messaging service earlier this week, causing severe disruptions to communications. [...]

security

Mustang Panda Upgrades CoolClient With a Kernel Rootkit

Mustang Panda upgraded CoolClient with a signed kernel driver that hides processes, files and network activity, making the backdoor harder to detect. HoneyMyte, also known as Mustang Panda, has pushed its CoolClient backdoor another step deeper into Windows. Kaspersky’s latest analysis shows a new variant that can deploy a signed kernel-mode driver as a Windows […]

malware

New AmnesiaStealer macOS malware hijacks browser sessions via remote control

A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser. [...]

ai

Stopping a cyberattack while walking your dog - defensive AI security CEO says it's not ruff to do

Corma CEO tells The Reg it's building 'One ring to rule them all, for the defenders to have this power'

breach

Sophisticated Cyberattack Exposes Data of 678,000 French Taxpayers

France’s tax agency says hackers stole data on 678,000 taxpayers, including income and tax details, in a sophisticated cyberattack. A threat actor claimed to have breached France’s tax agency in late June. France’s tax administration confirmed that a cyberattack exposed personal data of 678,000 individuals and businesses, prompting an immediate criminal investigation. The cybercrime unit […]