GS1900 Series Switches (Product): news timeline & CVEs

CISA Warns of Zyxel GS1900 Switches Flaw Actively Exploited in Attacks

CISA added exploited Zyxel GS1900 buffer overflow CVE-2026-7273 to KEV, warning of unauthenticated command execution.

CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on September 21, 2026, after confirming active exploitation. The flaw is a critical stack-based buffer overflow (CWE-121) in the CGI program of Zyxel GS1900 Series switches. An unauthenticated attacker on the local network can send a crafted HTTP request and execute operating-system commands on the switch. Federal remediation is due September 24, 2026, under BOD 26-04, which also requires forensic triage; ransomware use has not been confirmed.

Cyber Security Newsupdated Sep 22, 11:55 UTC · 4d agofirst Sep 22, 07:42 UTC · 5d agoExploit / PoC in the wild 8 sources CVE-2026-7273

CISA Adds One Known Exploited Vulnerability to Catalog

CISA added actively exploited Zyxel GS1900 stack buffer overflow CVE-2026-7273 to the Known Exploited Vulnerabilities catalog.

CISA added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 Series switches, to the Known Exploited Vulnerabilities Catalog after evidence of active exploitation. The agency describes this class of flaw as a frequent attack vector that can grant total control of publicly exposed assets. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of such KEV entries and to check for compromise before the patch. CISA urges all organizations to remediate KEV vulnerabilities using risk-based vulnerability management.

CISA AdvisoriesSep 21, 12:00 UTC · 5d agoExploit / PoC in the wildCVE-2026-72731

GS1900 Series Switches

Timeline2 articles

Related CVEsby mentions

Appears with

CISA Warns of Zyxel GS1900 Switches Flaw Actively Exploited in Attacks

CISA Adds One Known Exploited Vulnerability to Catalog