Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)
Chinese-speaking threat actor exploited a vulnerability in unpatched ZyXEL switches (CVE-2026-7273) affecting 996 devices across multiple countries; the exploit was contained in June 2026 and is now part of a broader…
A Chinese-speaking threat actor exploited a vulnerability in unpatched ZyXEL switches (CVE-2026-7273) affecting 996 devices across multiple countries; the exploit was contained in June 2026 and is now part of a broader operation targeting shared workstations, servers, and admin accounts.
- CVE-2026-7273
- ATT&CK
- T1566.001 Spearphishing AttachmentT1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for Impact
- Threat actors
- GreyNoiseArctic Wolf
- Countries
- ItalyUSTaiwanSouth KoreaEU
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-32996 | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation | 7.3 | <1% | PoC | |
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 8.8 | 3% | KEVPoC | KEV |
From the original article
2 min read at helpnetsecurity.com
A Chinese-speaking threat actor has exploited a vulnerability (CVE-2026-7273) in unpatched ZyXEL GS1900 Smart Managed Switches and has exfiltrated sensitive data from 996 devices across 48 countries, GreyNoise reported on Monday. The affected switches are predominantly located in Italy, the US, Taiwan, South Korea, and a number of EU countries.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.