Cisco Security Advisories - 2nd July 2026

Affected Environment

Cisco Catalyst Center (virtual and hardware appliances on AWS, Azure, and VMware ESXi) and Cisco Secure Endpoint Connector for Linux, Mac, and Windows, plus Secure Endpoint Private Cloud.

Threat Overview

Cisco disclosed multiple high-severity vulnerabilities affecting Cisco Catalyst Center and the third-party ClamAV component integrated into Cisco products. Successful exploitation could allow remote information disclosure or trigger denial of service conditions that impact system availability.

Exposure Timeline

Advisories issued 2 July 2026. No active exploitation in the wild confirmed at time of publication. Proof-of-concept code not yet available; the recommended remediation window is ten working days.

Attack Surface

Internet-facing Catalyst Center management interfaces and any system running ClamAV-based scanning. Unauthenticated remote attackers can reach these vulnerabilities over the network without credentials.

Technical Root Cause

CVE-2026-20191 (CVSS 7.5) - Insufficient validation of user-supplied input in Cisco Catalyst Center allows an unauthenticated remote attacker to read arbitrary files from a restricted container via crafted HTTP requests.

CVE-2026-20216 (CVSS 7.5) - Improper handling of temporary resources in the ClamAV InstallShield file format parser allows an unauthenticated attacker to terminate the ClamAV scanning process and temporarily exhaust system resources.

CVE-2026-20213 (CVSS 7.5) - Improper boundary checks in the ClamAV PE file format parser may result in an out-of-bounds buffer write, causing process termination or expanded impact from memory corruption.

CVE-2026-20214 (CVSS 7.5) - Improper boundary checks in the ClamAV FSG file format parser may result in an out-of-bounds buffer write when scanning FSG-compressed portable executable content.

CVE-2026-20215 (CVSS 7.5) - Improper boundary checks in the ClamAV 7z file format parser may result in an out-of-bounds buffer write, terminating the scanning process.

CVE-2026-20217 (CVSS 7.5) - Improper boundary checks in the ClamAV PESpin file format parser may result in an out-of-bounds buffer write.

CVE-2026-20243 (CVSS 7.5) - Improper boundary checks in the ClamAV ALZ file format parser may result in an out-of-bounds buffer write.

CVE-2026-20244 (CVSS 7.5) - Improper boundary checks in the ClamAV DMG file format parser may result in an integer overflow on 32-bit platforms, terminating the scanning process.

Exploitation Pathway

For CVE-2026-20191, an attacker sends a crafted HTTP request to an exposed Catalyst Center interface to extract arbitrary files. For all ClamAV vulnerabilities, an attacker submits a crafted file of the relevant format to be scanned, triggering the parser flaw and causing process termination or memory corruption.