This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco fixes 8 vulnerabilities, one actively exploited

Cisco fixes 8 vulnerabilities in its products. The most severe of them are described below; the rest can be found at the referenced links [1][2][3]. One vulnerability is already being actively exploited [3][4], and a PoC has been published for two others [2]. Fixed versions of individual products: ClamAV - 1.5.4, 1.4.6 [1] Secure Firewall Adaptive Security Appliance (ASA) Software - the specific hotfix can be found at [3] Secure Firewall Threat Defense (FTD) Software - the specific hotfix can be found at [3] Secure Endpoint Connector Linux/macOS/Windows* - available in the Cisco Secure Endpoint portal [5]; exact version numbers have not been published yet [2]. *The Secure Endpoint Private Cloud infrastructure is not vulnerable. However, it must be used to distribute the fixed connectors to endpoints; for more details see [2].

Cisco Secure Endpoint Connector, ClamAV - DoS (CVE-2026-20337)
CVSS 7.5 (High)

An unauthenticated remote attacker can write outside the bounds of allocated memory by submitting a specially crafted ZIP archive to the ClamAV scanning process in Secure Endpoint Connector, thereby causing a DoS of the running application [1][6]. According to the company, a PoC has already been published for this vulnerability, as well as for CVE-2026-20338 [6]. The vulnerability is less severe on Linux and macOS (CVSS 5.3), as the process runs with lower privileges [6].

The vulnerability is present in products:

  • ClamAV; >=1.5.0, <=1.5.3;
  • Secure Endpoint Connector;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

  • CVE-2026-20337 at cve.org, NVD
  • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') at cwe.mitre.org

The vulnerability was publicly disclosed 7. 8. 2026.

Cisco Secure Endpoint Connector, ClamAV - DoS (CVE-2026-20339)
CVSS 7.5 (High)

An unauthenticated remote attacker can cause a DoS of the running application by submitting a specially crafted file packed with the PESpin tool to the ClamAV scanning process in Secure Endpoint Connector [1][6]. The impact of the vulnerability is less severe on Linux and macOS (CVSS 5.3), as the process runs with lower privileges [6].

The vulnerability is present in products:

  • ClamAV; >=0.90, <=1.4.5; >=1.5.0, <=1.5.3;
  • Secure Endpoint Connector;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 7. 8. 2026.

Cisco Secure Endpoint Connector, ClamAV - DoS (CVE-2026-20346)
CVSS 7.5 (High)

An unauthenticated remote attacker can cause a DoS of the running application by submitting a specially crafted PDF file to the ClamAV scanning process in Secure Endpoint Connector [1][6]. The impact of the vulnerability is less severe on Linux and macOS (CVSS 5.3), as the process runs with lower privileges [6].

The vulnerability is present in products:

  • ClamAV; <=1.4.5; >=1.5.0, <=1.5.3;
  • Secure Endpoint Connector;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 7. 8. 2026.

Cisco Secure Firewall ASA & Secure FTD Software - DoS (CVE-2026-20349)
CVSS 8.6 (High)

An unauthenticated remote attacker can perform a DoS attack on the firewall by sending a specially crafted HTTP request to the Remote Access SSL VPN service in Cisco Secure Firewall ASA/FTD Software. The vulnerability affects only devices on which, according to show running-config, at least one of the features exposing SSL listen sockets is active, namely IKEv2 Remote Access VPN with client services (crypto ikev2 enable <interface_name> client-services port <port_numbers>), SSL VPN (webvpn / enable <interface_name>), or Zero Trust Network Access, available only on FTD (zero-trust enable) [3]. The vulnerability is already being actively exploited [3][4].

The vulnerability is present in products:

  • Secure Firewall Threat Defense Software;
  • Secure Firewall Adaptive Security Appliance Software;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X

More information:

  • CVE-2026-20349 at cve.org, NVD
  • CWE-244: Improper Clearing of Heap Memory Before Release ('Heap Inspection') at cwe.mitre.org

The vulnerability was publicly disclosed 11. 8. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 13. 8. 2026.

CESNET, z.s.p.o. Logo