Cisco Publishes July 1, 2026 Security Advisories: Catalyst Center File Read and ClamAV Flaws

Cisco's product security incident response team published its July 1 security advisory bundle covering CVE-2026-20191, an arbitrary file read vulnerability in Catalyst Center rated High with a CVSS base score of 7.5, alongside a set of seven ClamAV vulnerabilities affecting Cisco products, per the Cisco PSIRT advisories.

The ClamAV set comprises CVE-2026-20213, CVE-2026-20214, CVE-2026-20215, CVE-2026-20216, CVE-2026-20217, CVE-2026-20243 and CVE-2026-20244, per the advisories, also rated High with CVSS base scores of 7.5. Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories to fully remediate the flaws.

Exploitation status, workaround availability and the specific affected version ranges were not included in the material reviewed; those details sit in the individual advisories on Cisco's Security Advisories page, which is the authoritative record for each CVE in the bundle.

Background

Cisco PSIRT publishes advisories for its major software platforms in scheduled bundles as well as ad hoc releases, a cadence that lets enterprise security teams plan patch windows. Catalyst Center — the network management and automation platform formerly known as DNA Center — is a high-value target class in enterprise environments because it holds credentials for and configuration control over large switch and wireless estates; an arbitrary file read flaw in such a controller matters because the files exposed can include material useful for deeper compromise.

ClamAV is the open-source antivirus engine maintained under Cisco's Talos umbrella, and it is embedded in a range of Cisco security products as a scanning component — which is why a batch of ClamAV flaws propagates into formal Cisco advisories. Parsing vulnerabilities in antivirus engines carry particular weight because the engine, by design, processes untrusted files automatically and often runs with elevated privileges.

What comes next

The operational step, per Cisco's guidance, is for administrators to map deployed Catalyst Center and ClamAV-bearing product versions against the fixed releases listed in each advisory and schedule upgrades; Cisco says upgrading to the indicated software fully remediates the flaws. Watch the individual advisories for any revision noting proof-of-concept code or active exploitation, which would change the urgency calculus.