Zyxel Switches Exploited; Major Vendors Hit

Zyxel GS1900 series switches are being actively exploited in the wild, with attackers leveraging a stack-based buffer overflow vulnerability in the CGI program. This flaw, CVE-2026-7273, allows unauthenticated, LAN-based attackers to execute OS commands. The vulnerability affects firmware versions prior to 2.90(ABTQ.1)C0. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging organizations to prioritize patching. Multiple news outlets, including SecurityWeek and The Hacker News, have reported on the active exploitation, with nearly 1000 Zyxel switches compromised since August.

Critical vulnerabilities in Dell ObjectScale, versions prior to 4.4.0.0, could allow unauthenticated remote attackers to achieve remote code execution. CVE-2026-70416 is a deserialization of untrusted data vulnerability that poses a significant risk. The Hacker News and Cyber Security News have highlighted these critical flaws, emphasizing the potential for system compromise.

A critical deserialization vulnerability, CVE-2026-70416, has been identified in Dell ObjectScale versions prior to 4.4.0.0. This flaw allows unauthenticated remote attackers to execute arbitrary code on affected systems. The vulnerability has been noted by The Hacker News and Cyber Security News, underscoring the severity of the potential impact.

Apple products including macOS, iOS, iPadOS, and Safari are affected by a use-after-free vulnerability, CVE-2023-43000, which has been addressed in recent updates. Processing maliciously crafted web content could lead to memory corruption. Separately, CVE-2025-31277, also impacting Safari, iOS, iPadOS, and macOS, was fixed with improved memory handling. These vulnerabilities have been linked to the proliferation of exploit chains like DarkSword, as reported by Dark Reading and Mandiant Threat Intelligence.

SonicWall SonicOS management access is vulnerable to improper access control, potentially leading to unauthorized resource access and firewall crashes. CVE-2024-40766 is a critical vulnerability that has been noted by Tenable and SANS Internet Storm Center, with Mandiant Threat Intelligence linking it to ransomware tactics. While patches exist, misconfigurations may leave systems exposed.

Multiple critical vulnerabilities have been disclosed in Totolink and D-Link routers, as well as Netcore devices. These flaws, including command injection (CVE-2026-93742), buffer overflows (CVE-2026-93741, CVE-2026-93738), and other command execution vulnerabilities (CVE-2026-94089, CVE-2026-94100, CVE-2026-94099, CVE-2026-94095), pose a significant risk to home and small business networks. Oracle Access Manager also has a critical authentication bypass vulnerability, CVE-2026-71133.

HP's HPLIP software contains multiple critical vulnerabilities, including CVE-2026-91106, CVE-2026-91105, CVE-2026-91104, CVE-2026-91103, and CVE-2026-91102, which could allow for remote code execution, privilege escalation, and denial of service. These vulnerabilities have been remediated by HP.

A critical vulnerability in MongoDB, CVE-2026-93762, allows unauthenticated parties to obtain unintended information through unsafe reflection in the query path for embedded documents. Additionally, CareCam CM2507 IP cameras have a critical vulnerability, CVE-2026-85497, due to a hardcoded root password hash, making firmware images susceptible to cracking. CISA has issued an advisory for the CareCam vulnerability.