Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access
Zyxel disclosed an active exploitation of a stack-based buffer overflow in its GS1900 switch firmware (CVE-2026-7273), enabling OS command execution.
90
CVE-2026-7273
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVSS 3.1
- 8.8 high
- EPSS
- 3%p86
- Published
- ·
- Added to KEV
Description · NVD
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
KEVCISA Known Exploited Vulnerability
- Affected
- Zyxel GS1900 Series Switches
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- zyxel
- Products
- gs1900-8 firmware, gs1900-8hp firmware, gs1900-10hp firmware, gs1900-16 firmware, gs1900-24 firmware, gs1900-24e firmware, gs1900-24ep firmware, gs1900-24hpv2 firmware, gs1900-48 firmware, gs1900-48hpv2 firmware
- Weakness
- CWE-121
- Vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
13 storiesSeptember 2026 CVE Landscape
Recorded Future says 80 vulnerabilities were actively exploited in September 2026, including NetScaler zero-days.
85
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
A Chinese-linked actor exploited WordPress and Zyxel flaws, stealing government records from dozens of organizations.
82
Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers
Chinese hackers exploited ZyXEL CVE-2026-7273 on GS1900 switches in 48 countries; CISA added it to KEV.
82
Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents
Weekly roundup leads with a Gyazo breach of 23.6 million users and the TASK#STOMP document-stealing backdoor.
80
Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)
Chinese-speaking threat actor exploited a vulnerability in unpatched ZyXEL switches (CVE-2026-7273) affecting 996 devices across multiple countries; the exploit was contained in June 2026 and is now part of a broader…
80
CISA Warns of Zyxel GS1900 Switches Flaw Actively Exploited in Attacks
CISA added exploited Zyxel GS1900 buffer overflow CVE-2026-7273 to KEV, warning of unauthenticated command execution.
80
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation
GreyNoise tracks 'Red Heron' actor exploiting multiple vulnerabilities including novel ZyXEL CVE-2026-7273 and stealing 18,000+ government records.
80
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added actively exploited Zyxel GS1900 stack buffer overflow CVE-2026-7273 to the Known Exploited Vulnerabilities catalog.
76
U.S. CISA adds Zyxel flaw to its Known Exploited Vulnerabilities catalog
CISA added exploited Zyxel GS1900 switch flaw CVE-2026-7273 to the KEV catalog, with a September 24 fix deadline.
74
CISA orders feds to patch Zyxel flaw exploited for data theft
CISA added actively exploited Zyxel GS1900 flaw CVE-2026-7273 to KEV, ordering federal agencies to patch by Thursday after ~1,000 switches were compromised.
74
Zyxel security advisory (AV26-603) – Update 1
Canada's Cyber Centre says Zyxel GS1900 buffer overflow CVE-2026-7273 is now in CISA's KEV catalog.
71
CISA Flags Actively Exploited Flaw in Zyxel GS1900 Switches
CISA added actively exploited stack buffer overflow CVE-2026-7273 in Zyxel GS1900-48HPv2 switches to its KEV catalog with a September 24 remediation deadline.
65