CISA adds actively exploited Zyxel GS1900 flaw CVE-2026-7273 to KEV as GreyNoise tracks 996 compromised switches

CISA added actively exploited stack buffer overflow CVE-2026-7273 in Zyxel GS1900 switches to its KEV catalog on September 21, 2026, with a September 24 federal remediation deadline, after GreyNoise attributed the compromise of 996 switches across 48…

On September 21, 2026, CISA added CVE-2026-7273 — a stack-based buffer overflow in the CGI program of Zyxel GS1900 series switches, carrying a CVSS v3.1 score of 8.8 — to its Known Exploited Vulnerabilities catalog, citing active exploitation. The flaw lets an unauthenticated attacker on an adjacent/local network execute operating-system commands via a crafted HTTP request to the management interface; compromise enables traffic interception, credential theft, and lateral movement. Affected models span GS1900-8 through GS1900-48HPv2 (GS1900-48HPv2 firmware up to 2.90(ABTQ.1)C0). Federal agencies must apply mitigations or stop using affected products by September 24, 2026 — a three-day deadline — including forensic triage of exposed assets. Sources disagree on the governing directive: GBHackers, BleepingComputer, and SecurityWeek cite BOD 26-04, while Security Affairs cites BOD 22-01. Zyxel shipped fixes on June 16, 2026, in 2.90 second-release firmware builds for ten GS1900 models. GreyNoise reported that a suspected Chinese-speaking threat actor used an obfuscated Python script to pull hashed root credentials, configuration, and network data from 996 switches across 48 countries; 564 of the compromised devices still used factory-default credentials. Reports disagree on the exploitation timeline: BleepingComputer dates the first in-the-wild exploitation to September 17, 2026 (activity since mid-September), while SecurityWeek and Help Net Security place the campaign in August. GreyNoise assesses the actor as Red Heron or closely related; the same actor has chained Ubiquiti vulnerabilities for remote code execution, targeted WordPress in July, and stolen over 18,000 records from a Western government body. CISA did not name any attackers; ISCAS researchers are credited with reporting the flaw, and CISA now tracks 13 total exploited Zyxel vulnerabilities across routers, switches, firewalls, and NAS devices.