PatchDayAlert
Subscribe →
Daily Digest · 2 min read · 5 CVEs · Issue 74 By PatchDayAlert

ClamAV triple crash bugs and a Plesk SQL injection that dumps your whole panel DB

4 ClamAV parser flaws (all CVSS 7.5, one with a memory write primitive) can kill your scanning gateway with a single crafted file. Plus a CVSS 7.7 authenticated SQL injection in Plesk Obsidian that lets any logged-in user read every credential and customer record in the database.

Patch now
0
Within 24h
0
This week
5
Exploited
0
Plesk ObsidianLinuxWindowsClamAVCiscoMacOS

Moderately spicy Friday. Four ClamAV parser bugs dropped at once, all CVSS 7.5, all unauthenticated, and one of them is a write primitive that could mean code execution on your scanning gateway. There's also a Plesk Obsidian SQL injection that lets any authenticated user dump the full panel database. Nothing exploited in the wild yet, but if you run ClamAV on a mail or upload pipeline, don't wait on these.

Today's CVEs

Sorted by urgency

01

CVE-2026-64636

NVD
7.7
CVSS
Patch this week HIGH
Plesk ObsidianLinuxWindows

An authenticated user on Plesk Obsidian can inject SQL queries and read anything in the panel's database. That means credentials, customer data, DNS records, mail configs: whatever Plesk stores. The attacker needs a valid Plesk login first, which limits drive-by risk, but any compromised or rogue reseller account could dump the whole database.

Affected estate
Anyone running Plesk Obsidian 18.0.80 or earlier on Linux or Windows
How to check
Run 'plesk version' on the server or check the Plesk UI under Tools & Settings > Updates & Upgrades to confirm the installed version.
Included because
authenticated but low-complexity SQL injection; shared hosting panel; sensitive data exposure; CVSS 7.7
Action
Update Plesk Obsidian to the latest release via the built-in updater or CLI ('plesk installer --select-release-latest').
Why it matters
A single authenticated account can read the entire panel database, exposing credentials, customer data, and server configuration.
Source
Plesk vendor advisory

Evidence trail

02

CVE-2026-20348

NVD
7.5
CVSS
Patch this week HIGH
ClamAVCiscoLinuxWindows

An attacker can crash ClamAV (or potentially corrupt memory) by sending a crafted XAR archive for scanning. No authentication is needed. If ClamAV sits on your mail gateway or web upload pipeline, a single malicious file could kill scanning and let subsequent payloads slip through unexamined.

Affected estate
Anyone running ClamAV on mail gateways, file upload scanners, or endpoint protection
How to check
Run 'clamscan --version' or 'clamd --version' and compare against the fixed version listed in Cisco's advisory.
Included because
unauthenticated; remotely triggerable; common infrastructure component; DoS plus possible memory corruption; CVSS 7.5
Action
Update ClamAV to the latest patched version via your OS package manager or Cisco's release channel.
Why it matters
A crafted file can crash the scanning process, creating a window where malicious content passes through unscanned.
Source
Cisco Security Advisory

Evidence trail

03

CVE-2026-20347

NVD
7.5
CVSS
Patch this week HIGH
ClamAVCiscoLinuxWindowsMacOS

A crafted Mach-O binary can trigger an out-of-bounds read in ClamAV's parser, crashing the scanner. No authentication required. On a busy mail or file-scanning gateway, this kills your AV layer and lets everything behind it flow through unchecked.

Affected estate
Anyone running ClamAV on mail gateways, file upload scanners, or endpoint protection
How to check
Run 'clamscan --version' and compare against the fixed version in Cisco's advisory.
Included because
unauthenticated; remotely triggerable; common infrastructure component; CVSS 7.5
Action
Update ClamAV to the latest patched version.
Why it matters
Crashing the AV scanner opens a gap where malware passes through your pipeline without inspection.
Source
Cisco Security Advisory

Evidence trail

04

CVE-2026-20345

NVD
7.5
CVSS
Patch this week HIGH
ClamAVCiscoLinuxWindows

A crafted GPT partition image can trigger an out-of-bounds write in ClamAV's parser due to a bad endian conversion. This is the nastiest of the current ClamAV batch because it's a write, not just a read, so memory corruption and potential code execution are on the table. No auth needed: just get ClamAV to scan the file.

Affected estate
Anyone running ClamAV on mail gateways, file upload scanners, or endpoint protection
How to check
Run 'clamscan --version' and compare against the fixed version in Cisco's advisory.
Included because
unauthenticated; remotely triggerable; out-of-bounds write (higher impact than read); common infrastructure component; CVSS 7.5
Action
Update ClamAV to the latest patched version. If patching is delayed, evaluate excluding GPT file scanning as a short-term mitigation.
Why it matters
An out-of-bounds write creates realistic risk of code execution on your scanning infrastructure, not just a crash.
Source
Cisco Security Advisory

Evidence trail

05

CVE-2026-20339

NVD
7.5
CVSS
Patch this week HIGH
ClamAVCiscoLinuxWindows

A crafted PESpin-packed executable can trigger an integer overflow in ClamAV's parser, crashing the scan process or potentially corrupting memory. No authentication needed. If your gateway scans inbound executables, an attacker can weaponize this to take your AV offline.

Affected estate
Anyone running ClamAV on mail gateways, file upload scanners, or endpoint protection
How to check
Run 'clamscan --version' and compare against the fixed version in Cisco's advisory.
Included because
unauthenticated; remotely triggerable; integer overflow with memory corruption potential; common infrastructure component; CVSS 7.5
Action
Update ClamAV to the latest patched version.
Why it matters
Crashing the AV scanner removes your front-line defense, letting subsequent malicious payloads through unchecked.
Source
Cisco Security Advisory

Evidence trail

One email, every Wednesday morning.

Subscribe

From the field notes

From this beat

Read the rest of the field notes →