CISCO: Reference: Cisco Security Advisory – ClamAV Vulnerabilities July 2026

CISCO Security Advisory

Published Date: July 2, 2026

CVE: CVE-2026-20213

Advisory Summary

🔔 Security Alert: ClamAV Vulnerabilities Impacting Cisco Secure Endpoint Connectors

Cisco has identified multiple critical vulnerabilities within ClamAV antivirus software that could enable remote attackers to trigger denial-of-service (DoS) conditions, severely disrupting scanning operations. The risk is particularly high on Windows-based platforms such as Cisco Secure Endpoint Connector for Windows, where ClamAV runs with privileged security context, leading to a High Security Impact Rating (SIR). Linux and Mac platforms have a Medium SIR due to a lower-privileged scanning context. Notably, Cisco Secure Endpoint Private Cloud remains unaffected, though the connectors it distributes are vulnerable.

⚠️ No workarounds exist; Cisco has issued software updates to mitigate these threats. Immediate patching is strongly recommended to avoid interruptions in endpoint security scanning and potential exploitation.

• High severity on Windows platforms (privileged context)
• Medium severity on Linux/Mac platforms (lower privilege)
• Affected Cisco product: Secure Endpoint Connector (Windows, Linux, Mac)
• Secure Endpoint Private Cloud unaffected
• Critical CVEs involved: CVE-2026-20213 through CVE-2026-20217, CVE-2026-20243, CVE-2026-20244
• No mitigations other than patching

Enterprise security teams should prioritize deploying Cisco’s updates to maintain resilient endpoint defenses and prevent service downtime due to DoS attacks targeting ClamAV.

Reference: Vendor Advisory