In plain language
What this advisory means
Several security problems were found in the ClamAV antivirus scanning software used by Cisco. These problems can allow an attacker to remotely cause the scanning software to stop working, interrupting the device's ability to scan for threats. This is called a denial of service (DoS) attack. Cisco's Windows-based products are at higher risk because the scanning software runs with high privileges there. Linux and Mac products are also affected but with medium risk because the scanning software runs with fewer privileges on those systems. Cisco is releasing updates to fix these issues. No workarounds are currently available, so updating is important to keep devices secure.
Technical explanation
How the issue affects the environment
Multiple vulnerabilities in different file parsers of the ClamAV antivirus engine used by Cisco products can be triggered remotely by submitting specially crafted files. These vulnerabilities include out-of-bounds writes, memory corruption due to double-free, integer overflow, improper boundary checks, and improper endian conversion handling during scanning of ZIP, PESpin, GPT, PDF, Mach-O, and XAR file formats. Exploiting these can cause the ClamAV scanning process to terminate, resulting in denial-of-service conditions on affected devices. Windows platforms have a High Security Impact Rating because the ClamAV scanning executes with privileged security context, increasing the risk severity. Linux and Mac platforms have a Medium rating due to execution in lower-privileged contexts. No mitigations or workarounds exist; fixed software releases are planned to fully address these issues.
Operational impact
Why teams should care
Organizations using Cisco Secure Endpoint Connectors on Windows, Linux, or Mac may experience interruptions in malware scanning capabilities due to these vulnerabilities. This denial of service can reduce device security and potentially allow threats to go undetected during the downtime. Windows-based endpoints are at higher risk due to the privileged execution of scanning software, increasing potential exposure. There is no workaround, so without timely updates, businesses face ongoing risk of service interruptions and security gaps affecting endpoint protection.
Immediate action
Cisco strongly recommends upgrading affected Cisco Secure Endpoint Connector software to the released fixed versions once available. For Secure Endpoint Private Cloud customers, updating to version 4.2.8 or later ensures endpoint connector updates include the fixes. Software updates will address all known vulnerabilities. Regular updates through Cisco Secure Endpoint portal or usual update mechanisms should be followed to fully mitigate these security issues.
Affected and fixed releases
Temporary risk reduction
The advisory states that there are no workarounds available to address these vulnerabilities. Until fixed software updates are applied, devices remain vulnerable to denial of service via crafted files targeting ClamAV parsers.
Evidence and validation checklist
- Cisco PSIRT advisory cisco-sa-clamav-WuuvVd26 published August 7, 2026
- Descriptions of multiple DoS vulnerabilities in ClamAV file format parsers affecting Cisco Secure Endpoint products
- Security Impact Rating High for Windows platforms due to privileged process context
- Security Impact Rating Medium for Linux and Mac platforms
- No workarounds exist per Cisco advisory
- Proof-of-concept code available for two CVEs
- Cisco planned fixed releases in August 2026
- Cisco Secure Endpoint Private Cloud not directly affected but distributes vulnerable connector software
- Linked CVEs with assigned identifiers and descriptions
Authoritative reference
Cisco PSIRT Advisories
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.