As reported by BleepingComputer, Cisco has disclosed two high-severity denial-of-service vulnerabilities in the ClamAV scanning engine embedded within Cisco Secure Endpoint Connector — and critically, public proof-of-concept exploits already exist for both. This combination of high severity, confirmed exploitability, and public PoC code compresses the window defenders have to act before opportunistic threat actors weaponize these flaws at scale.

Security Impact: As reported by BleepingComputer, Cisco has disclosed two high-severity denial-of-service vulnerabilities in the ClamAV scanning engine embedded within Cisco Secure Endpoint Connector — and critically, public proof-of-concept exploits already exist for both.

Vulnerability Overview

CVE-2025-20128
Severity: High | Type: Denial-of-Service — OLE2 file parser heap buffer over-read
Impact: Crashes the ClamAV scanning process; can be triggered by a specially crafted file submitted for scanning
Public Exploit: Yes
Active Wild Exploitation: Not confirmed at time of disclosure
CVE-2025-20111
Severity: High | Type: Denial-of-Service — ClamAV scanning process crash
Impact: Terminates the ClamAV daemon, disabling AV inspection until service is restarted
Public Exploit: Yes
Active Wild Exploitation: Not confirmed at time of disclosure

Affected Products & Versions

Vulnerability Overview
Cisco Secure Endpoint Connector for Linux — versions prior to the patched release
Cisco Secure Endpoint Connector for macOS — versions prior to the patched release
Cisco Secure Endpoint Connector for Windows — versions prior to the patched release
ClamAV open-source engine — versions that include the vulnerable OLE2 parser and scanning process components

Organizations running standalone ClamAV deployments — not just Cisco Secure Endpoint — should also evaluate their exposure, as the vulnerable engine is embedded in a wide range of mail gateways, file servers, and third-party security products that bundle ClamAV.

Why This Matters Beyond the Headline

DoS vulnerabilities against antivirus engines are a particularly insidious class of flaw that deserves more attention than they typically receive. The immediate instinct is to dismiss them as "just a crash" — but consider the adversarial logic: if an attacker can reliably crash the AV scanning process before delivering a malicious payload, they have effectively blinded one layer of your defense-in-depth stack. This is a classic defense degradation technique, and it pairs dangerously well with follow-on malware deployment.

"A vulnerability that silences your scanner is, functionally, a precursor to one that compromises your systems. Never underestimate DoS flaws in security tooling."

The existence of public PoC exploits is the defining risk amplifier here. In our experience, weaponization timelines for high-severity flaws with available PoC code frequently compress to 24–72 hours in active threat campaigns. Ransomware affiliates and initial access brokers routinely monitor vulnerability disclosure feeds and adapt public PoCs into their toolchains with minimal friction.

Who Is Most at Risk

  • Enterprises with large Cisco Secure Endpoint deployments — particularly those where AV scanning is a primary or sole malware detection control at the endpoint
  • Email security gateways running ClamAV — file-based triggering via email attachments makes remote exploitation trivial in these configurations
  • Managed Security Service Providers (MSSPs) — a single vulnerable scanning node processing client files could be targeted to disable visibility across multiple customers
  • Linux and macOS environments — often considered lower-risk by security teams, but these platforms frequently run unattended ClamAV daemons with less monitoring attention

Shield53 Recommendations — Immediate Actions

  1. Patch immediately. Apply Cisco's updated Secure Endpoint Connector release as soon as it is available in your deployment channel. Prioritize internet-facing or email-adjacent nodes first.
  2. Update standalone ClamAV instances. Audit your environment for any standalone ClamAV deployments — mail relays, file servers, CI/CD pipelines — and apply the ClamAV upstream patch. These systems are often overlooked in enterprise patch cycles.
  3. Enable process restart monitoring. Configure alerting on unexpected ClamAV process terminations. An unexplained daemon crash should be treated as a potential exploitation attempt and trigger incident response review.
  4. Implement layered file inspection. If your architecture allows, ensure that files are not solely inspected by ClamAV. Supplement with cloud-based sandboxing or a secondary AV engine to maintain coverage if one layer is degraded.
  5. Review ingestion points for untrusted files. Assess which interfaces accept externally-sourced files for scanning (email, web uploads, shared drives) and apply additional validation or rate limiting as a temporary mitigation where patching is delayed.
  6. Monitor Cisco's PSIRT advisory for any updates indicating confirmed active exploitation, which should elevate this to emergency patch priority.

Broader Implication for Security Teams

This incident is a timely reminder that security tooling itself is attack surface. AV engines, EDR agents, and scanning daemons parse untrusted, attacker-controlled content by design — making them structurally attractive targets for memory corruption and parser-based attacks. Security leaders should ensure their vulnerability management programs explicitly include security tooling vendors in scope, and that patch SLAs for security products are at least as aggressive as those applied to operating systems and browsers.