CISA Warns of Zyxel GS1900 Switches Flaw Actively Exploited in Attacks
CISA added exploited Zyxel GS1900 buffer overflow CVE-2026-7273 to KEV, warning of unauthenticated command execution.
CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on September 21, 2026, after confirming active exploitation. The flaw is a critical stack-based buffer overflow (CWE-121) in the CGI program of Zyxel GS1900 Series switches. An unauthenticated attacker on the local network can send a crafted HTTP request and execute operating-system commands on the switch. Federal remediation is due September 24, 2026, under BOD 26-04, which also requires forensic triage; ransomware use has not been confirmed.
- CVE-2026-7273 is a critical stack-based buffer overflow in Zyxel GS1900 CGI.
- Unauthenticated local attackers can run operating-system commands via crafted HTTP requests.
- Added to CISA KEV on September 21, 2026; patch deadline is September 24.
- BOD 26-04 requires forensic triage, not patching alone.
- CISA has not linked the flaw to ransomware campaigns.
- CVEs
- CVE-2026-7273
- Vendors
- Zyxel
- Products
- GS1900 Series Switches
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 8.8 | 3% | KEVPoC | KEV |
From the original article
2 min read at cybersecuritynews.com
CISA added CVE-2026-7273, a critical stack-based buffer overflow in the CGI program of Zyxel GS1900 Series Switches, to its KEV catalog after confirming active exploitation. The vulnerability could allow an unauthenticated attacker on the local network to send a specially crafted HTTP request to a vulnerable device. Successful exploitation may enable the attacker to execute […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.