Vulnerabilities
ClamAV Vulnerabilities Enable Remote DoS on Cisco Secure Endpoint Connectors
A bundle of seven CVEs (CVE‑2026‑20337 through CVE‑2026‑20348) in ClamAV lets attackers trigger a denial‑of‑service on Cisco Secure Endpoint Connector software. The flaw is most critical on Windows, where the scanner runs with elevated privileges, but still poses a medium risk on Linux and macOS. Cisco has pushed patches for all affected platforms; no work‑arounds exist. The Private Cloud service itself remains unaffected, though its on‑device connector is vulnerable.
Seven newly disclosed ClamAV bugs give a remote attacker the ability to crash the scanner and halt all file‑checking operations on Cisco’s Secure Endpoint Connector. The attacks rely on malformed input that overflows buffers within the ClamAV engine, leading to a DoS condition.
Impact by Platform
- Windows – The scanner runs with system‑level rights, so a successful exploit can bring down the entire endpoint agent. Cisco rates the security impact as High for Windows.
- Linux & macOS – The connector operates under a lower‑privileged user, reducing the damage scope. The impact is rated as Medium on these operating systems.
- Secure Endpoint Private Cloud – The cloud‑hosted service is not affected, but the on‑device connector distributed from it is.
Mitigation
- Apply the latest Cisco software updates that patch the ClamAV vulnerabilities.
- No work‑arounds are available; the only defense is to install the fix promptly.
“Cisco has released updates that address these vulnerabilities in affected platforms. There are no workarounds that mitigate the issue.”
Security teams should verify that the updated connector is deployed across all endpoints and monitor for any abnormal scanning behavior.
Related vulnerabilities
MongoDB Faces Multi‑Vector Exploits: DoS, Data Breach & Integrity Hits Across Drivers & Server
CERT‑FR has issued a critical alert on September 14, 2026 after discovering a suite of vulnerabilities in MongoDB that span the core server and a wide range of drivers (C, C#, C++, Go, Java, PHP, Python, Ruby, Rust). The flaws allow attackers to trigger remote denial‑of‑service, leak sensitive data, and tamper with database contents. All versions prior to the listed releases are affected. Immediate patching and configuration hardening are mandatory.
Read briefing
Ivanti Connect Secure & Policy Secure Gateways Hit by Multi‑Vulnerability Surge – Patch Now
A wave of critical flaws—CVE‑2024‑22024, CVE‑2024‑21888, CVE‑2024‑21893, CVE‑2023‑46805, CVE‑2024‑21887—has been actively exploited against Ivanti Connect Secure and Policy Secure Gateways. The bugs enable unauthenticated privilege escalation, SSRF, and remote code execution, letting attackers hijack devices and steal credentials. Ivanti released patches for most affected versions in February, with additional fixes rolled out through March. Immediate patching, re‑authentication, and hardened configuration are essential to stop attackers from leveraging these weaknesses.
Read briefing
Cisco FMC Java Deserialization Flaw Lets Remote Attacker Gain Root
Cisco’s Secure Firewall Management Center (FMC) suffers a critical insecure Java deserialization bug that permits unauthenticated remote actors to execute arbitrary code as root. By sending a crafted Java byte stream to a specific TCP port from a host listed in the external database access list, an attacker can elevate privileges and run any command. No workaround exists; Cisco has released patches for the affected releases. The flaw is catalogued as CVE‑2026‑20242 and rated Critical.
Read briefing
Mozilla Products Hit by 20+ Critical Vulnerabilities
The French CERT released an alert on September 16, 2026, detailing a suite of 22 CVEs affecting older releases of Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. The flaws enable attackers to elevate privileges, launch remote denial‑of‑service attacks, and exfiltrate sensitive data. Patches are available through Mozilla’s MFSA 2026‑90 to 2026‑95 advisories. All affected users should update immediately.
Read briefing