Zyxel

Mentions · 7d0
Mentions · 30d0
All mentions4
First seenSep 21, 2026
Last mentionedSep 22, 2026

Timeline

4 articles · newest first

CISA orders feds to patch Zyxel flaw exploited for data theft

CISA added actively exploited Zyxel GS1900 flaw CVE-2026-7273 to KEV, ordering federal agencies to patch by Thursday after ~1,000 switches were compromised.

BleepingComputerSep 22, 08:53 UTC · Sep 22, 2026Exploit / PoCExploited2 sourcesCVE-2026-7273 CVE-2024-408912 · 1 read

CISA Flags Actively Exploited Flaw in Zyxel GS1900 Switches

CISA added actively exploited stack buffer overflow CVE-2026-7273 in Zyxel GS1900-48HPv2 switches to its KEV catalog with a September 24 remediation deadline.

GBHackersupdated Sep 22, 08:53 UTC · Sep 22, 2026first Sep 22, 08:37 UTC · Sep 22, 2026Exploit / PoCExploited2 sourcesCVE-2026-72731

Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

Zyxel disclosed an active exploitation of a stack-based buffer overflow in its GS1900 switch firmware (CVE-2026-7273), enabling OS command execution.

The Hacker NewsSep 22, 05:31 UTC · Sep 22, 2026Exploit / PoCExploitedCVE-2026-72734 · 1 read

Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

GreyNoise tracks 'Red Heron' actor exploiting multiple vulnerabilities including novel ZyXEL CVE-2026-7273 and stealing 18,000+ government records.

GreyNoiseSep 21, 00:00 UTC · Sep 21, 2026Threat actorExploitedCVE-2026-7273 CVE-2026-34908 CVE-2026-34909+93 · 1 read

Related CVEs

by mentions

CVE-2026-72733%8.8
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
published Jun 16, 2026Zyxel GS1900 Series SwitchesKEVPoC
CVE-2026-3490889%10.0
Improper Access Control in Ubiquiti UniFi OS Devices (CVE-2026-34908)
published May 22, 2026Ubiquiti UniFi OS ServerKEVPoC
CVE-2026-3491090%10.0
Unauthenticated Command Injection in Ubiquiti UniFi OS Devices
published May 22, 2026Ubiquiti (ui) UniFi OSKEVPoC
CVE-2026-3490969%10.0
Unauthenticated Path Traversal in Ubiquiti UniFi OS Devices
published May 22, 2026Ubiquiti UniFi OS ServerKEVPoC
CVE-2026-6000424%9.8
Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection
published Aug 26, 2026GiteaKEVPoC ×5
CVE-2026-6303011%9.8
WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
published Jul 17, 2026WordPress CoreKEVPoC ×9
CVE-2024-4089123%8.8
Post-Authentication OS Command Injection in Zyxel DSL CPE Devices
published Feb 4, 2025Zyxel DSL CPE Devices (multiple models)KEV
CVE-2022-084793%7.8
Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel
published Mar 10, 2022Linux KernelKEVPoC ×4
CVE-2026-56271<1%9.3
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and…
published Jul 12, 2026flowiseai flowise
CVE-2026-797565%8.7
Unauthenticated OS Command Injection in Nuclio Dashboard (Local/Docker Platform)
published Sep 2, 2026Nuclio (open-source project) Nuclio Dashboard (local/Docker platform)

Appears with

CISAorganization · 3
GreyNoiseorganization · 2
Zyxelvendor · 2
Ubiquitivendor · 1
Proxmoxorganization · 1
Giteaproduct · 1
Russian state entityvictim · 1
WordPressorganization · 1
ISCASorganization · 1
PAN-OS GlobalProtectproduct · 1
Linux Kernelproduct · 1
UniFi OSproduct · 1
Western governmentvictim · 1
Red Heronmalware · 1
WordPressvendor · 1
Ubiquitiorganization · 1

Entities are extracted by the model from each article. First seen Sep 21, 2026, last mentioned Sep 22, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.