Zyxel (Organization): news timeline & CVEs

CISA orders feds to patch Zyxel flaw exploited for data theft

CISA added actively exploited Zyxel GS1900 flaw CVE-2026-7273 to KEV, ordering federal agencies to patch by Thursday after ~1,000 switches were compromised.

CISA added CVE-2026-7273, a stack-based buffer overflow in the CGI program of Zyxel GS1900 switches allowing unprivileged LAN attackers to execute OS commands via crafted HTTP requests, to its KEV Catalog and ordered FCEB agencies to patch by Thursday under BOD 26-04; Zyxel shipped fixes on June 16. GreyNoise reported a suspected Chinese-speaking actor exploiting the flaw as a novel vector since mid-September, compromising and exfiltrating data from 996 switches across 48 countries while targeting over a dozen other vulnerabilities. CISA tracks 13 total exploited Zyxel vulnerabilities across routers, switches, firewalls, and NAS devices; affected models span GS1900-8 through GS1900-48HPv2 with firmware 2.90 variants.

BleepingComputerupdated Sep 22, 11:55 UTC · 4d agofirst Sep 22, 08:53 UTC · 5d agoExploit / PoC in the wild 8 sources CVE-2026-7273 CVE-2024-40891

CISA Flags Actively Exploited Flaw in Zyxel GS1900 Switches

CISA added actively exploited stack buffer overflow CVE-2026-7273 in Zyxel GS1900-48HPv2 switches to its KEV catalog with a September 24 remediation deadline.

CISA added CVE-2026-7273, a stack-based buffer overflow in the CGI program of Zyxel GS1900-48HPv2 switches (firmware up to 2.90(ABTQ.1)C0), to the KEV catalog on September 21, 2026, citing active exploitation. The flaw carries a CVSS v3.1 score of 8.8 and lets an unauthenticated attacker on an adjacent network execute OS commands via a crafted HTTP request to the management interface. Federal agencies must apply mitigations or stop using affected products by September 24 under BOD 26-04, including forensic triage of exposed assets.

GBHackersupdated Sep 22, 11:55 UTC · 4d agofirst Sep 22, 08:37 UTC · 5d agoExploit / PoC in the wild 8 sources CVE-2026-7273

Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

Zyxel disclosed an active exploitation of a stack-based buffer overflow in its GS1900 switch firmware (CVE-2026-7273), enabling OS command execution.

Zyxel disclosed a stack-based buffer overflow in its GS1900 switch firmware (CVE-2026-7273, CVSS 8.8) that enables OS command execution, with evidence of active exploitation.

The Hacker Newsupdated Sep 22, 11:55 UTC · 4d agofirst Sep 22, 05:31 UTC · 5d agoExploit / PoC in the wild 8 sources CVE-2026-72733

Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

GreyNoise tracks 'Red Heron' actor exploiting multiple vulnerabilities including novel ZyXEL CVE-2026-7273 and stealing 18,000+ government records.

GreyNoise identified a suspected Chinese-speaking threat actor ('Red Heron') conducting widespread exploitation across multiple technologies since June 2026. The actor exploited Ubiquiti, WordPress, ZyXEL, Gitea, and other products, stealing over 18,000 sensitive records from a western government. A novel zero-day exploitation of CVE-2026-7273 in ZyXEL GS1900 switches affected 996 devices globally. GreyNoise observed patterns suggesting the actor used LLMs to generate custom attack tools.

GreyNoiseSep 21, 00:00 UTC · 6d agoThreat actor in the wildCVE-2026-7273 CVE-2026-34908 CVE-2026-34909+9 CVEs

Zyxel

Timeline4 articles

Related CVEsby mentions

Appears with

CISA orders feds to patch Zyxel flaw exploited for data theft

CISA Flags Actively Exploited Flaw in Zyxel GS1900 Switches

Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation