Loading story…
Cisco released security updates for Meeting Management, Secure Endpoint Connector on Linux, macOS, and Windows, Secure Endpoint Private Cloud, and BroadWorks to remediate multiple vulnerabilities, including a critical flaw in Cisco Meeting Management tracked as CVE-2025-20156. The bug affects authorization validation in the REST API and allows an authenticated remote attacker to escalate privileges to administrator, potentially taking full control of managed nodes. Cisco also patched CVE-2025-20165 in BroadWorks, where crafted SIP requests can trigger a denial of service.
ClamAV separately published patch releases 1.4.2 and 1.0.8 to fix CVE-2025-20128, a parser flaw in OLE2 file handling that affects all currently supported versions since ClamAV 1.0.0 and was identified by OSS-Fuzz. Cisco said the same ClamAV issue affects Secure Endpoint products, where crafted files could disable the antivirus component, and noted that proof-of-concept exploit code is available. The ClamAV releases also address a ClamOnAcc stability problem that could cause an infinite loop when a watched directory does not exist.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Cisco released security updates for Meeting Management, Secure Endpoint Connector for Linux, Mac, and Windows, Secure Endpoint Private Cloud, and BroadWorks to address multiple vulnerabilities. The advisory highlighted critical privilege-escalation flaw CVE-2025-20156 in Cisco Meeting Management, ClamAV-related CVE-2025-20128 affecting Secure Endpoint products, and denial-of-service flaw CVE-2025-20165 in BroadWorks.
ClamAV released versions 1.4.2 and 1.0.8 to fix CVE-2025-20128, described as a possible buffer overflow read bug in the OLE2 file parser affecting supported versions since 1.0.0. The release also credited OSS-Fuzz with identifying the issue and included a ClamOnAcc stability fix in 1.0.8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ClamAV released security patch versions **1.5.4** and **1.4.6** to fix seven vulnerabilities in the antivirus engine, along with additional stability issues affecting archive, partition, PDF, Mach-O, and PE parsing. The updates also incorporate an upstream UnRAR fix for `CVE-2025-8088`, resolve thread-safety problems in the `clamd` `STATS` command that could leak memory or crash the daemon, restore safe quarantine behavior on FreeBSD, and in **1.5.4** fix an OpenSSL library-context leak in legacy hashing helpers. Both releases also update the Rust `crossbeam-epoch` dependency to remediate `RUSTSEC-2026-0204`. Advisories highlighted **`CVE-2026-20337`** and **`CVE-2026-20338`** as high-severity ZIP archive parser denial-of-service flaws caused by improper input validation during scanning, with public proof-of-concept code reportedly available. An unauthenticated remote attacker could submit crafted archives to disrupt scanning operations and affect service availability. Affected versions include ClamAV **1.5.x before 1.5.4** and **1.4.x before 1.4.6**, while Cisco said related fixes also apply to **Secure Endpoint Connector** for Windows, Linux, and macOS and to **Private Cloud 4.2.x before 4.2.8**, with updated connector builds being released through August.
Aug 13, 2026
Cisco issued a high-severity advisory and patches for **Cisco Meeting Management** addressing **CVE-2026-20098** (reported as **CVSS 8.8**), an **authenticated remote arbitrary file upload** flaw in the product’s *Certificate Management* web interface. Due to **improper input validation**, an attacker with valid credentials—requiring as little as the **“video operator”** role—can send crafted HTTP requests to upload malicious files that may overwrite system files and be processed by the **root** account, enabling **arbitrary command execution** and **privilege escalation to root**. Cisco also released fixes for a separate issue in its video endpoint software: **CVE-2026-20119** (reported as **CVSS 7.5**) affecting **Cisco TelePresence Collaboration Endpoint (CE) Software** and **Cisco RoomOS**, where a flaw in the **text rendering subsystem** can allow an **unauthenticated remote attacker** to trigger a **denial-of-service (DoS)** condition on affected devices. Organizations running these collaboration platforms should prioritize applying the vendor updates, particularly where Meeting Management is exposed to users beyond tightly controlled admin groups.
Jun 29, 2026
Cisco released security updates for multiple products after disclosing at least 15 vulnerabilities, including **eight critical** issues and several high-severity flaws. The most serious bugs affect **Cisco Secure Workload** and **Cisco Crosswork Data Gateway**, where vulnerabilities rated up to `CVSS 10.0` could allow **authentication bypass, remote code execution, path traversal, file overwrite or deletion, data manipulation, and filesystem compromise**. Cisco issued fixes including **Secure Workload 4.0.4.16 and 3.10.9.1** and patches for **Crosswork 7.2.1-SP**, while urging customers to follow product-specific security bulletins and upgrade affected systems promptly. Cisco also patched a high-severity **XML External Entity** flaw in **Cisco BroadWorks**, tracked as `CVE-2026-20320`, which could let unauthenticated attackers read sensitive configuration data and files through the OCI-P provisioning service; affected BroadWorks releases earlier than `RI.2026.07` should be upgraded because no workaround is available. Additional fixes were issued for products including **Network Controller**, **Planning**, **Packaged Contact Center Enterprise**, **RoomOS**, **Industrial Ethernet 1000 Series Switches**, **Unified Intelligence Center**, and **Cisco Talos Intelligence for Enterprise Security Cloud**. Cisco said it had **no evidence of active exploitation** at the time of disclosure.
Aug 24, 2026