CISA Adds Zyxel Switch Vulnerability to KEV Catalog Amid Active Exploitation
CISA has added CVE-2026-7273, a stack-based buffer overflow vulnerability in Zyxel GS1900 Series Switches, to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical vulnerability affecting Zyxel GS1900 Series Switches to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability, identified as CVE-2026-7273, is a stack-based buffer overflow that has been observed under active exploitation by malicious cyber actors.
This inclusion in the KEV Catalog signifies that CISA has confirmed evidence of real-world attacks leveraging this flaw. Such vulnerabilities are considered high-risk because they can provide attackers with significant control over affected systems, posing a substantial threat to organizational security. The nature of stack-based buffer overflows often allows attackers to overwrite critical memory regions, potentially leading to arbitrary code execution.
As a result of this addition, federal civilian executive branch (FCEB) agencies are now mandated by Binding Operational Directive (BOD) 26-04 to prioritize the remediation of CVE-2026-7273 on any publicly exposed assets. This directive emphasizes a risk-based approach to vulnerability management, requiring agencies to address vulnerabilities that offer complete control post-exploitation with urgency.
BOD 26-04 also mandates that federal agencies assess whether systems were compromised before applying patches, a crucial step in understanding the full impact of an exploit. While the directive specifically targets FCEB agencies, CISA strongly encourages all organizations, including those in the private sector, to adopt similar risk-based vulnerability management practices.
The KEV Catalog serves as a vital resource for organizations seeking to understand and mitigate the most pressing cyber threats. CISA continuously monitors threat intelligence and actively adds vulnerabilities to the catalog when evidence of exploitation emerges, ensuring that organizations can focus their limited resources on the most critical security updates.
Organizations are urged to consult CISA's KEV Catalog for the latest information on exploited vulnerabilities and to implement timely patching and mitigation strategies. CISA also provides a nomination form for the public to submit evidence of exploited vulnerabilities not yet listed in the catalog, provided they have a CVE ID, proof of exploitation, and clear mitigation guidance.
The addition of CVE-2026-7273 to the KEV Catalog underscores the persistent threat posed by vulnerabilities in network infrastructure devices. These devices, often overlooked in security assessments, can serve as critical entry points for attackers seeking to infiltrate networks or disrupt operations.
The new article provides additional details on the exploitation of CVE-2026-7273, specifically mentioning that the vulnerability allows for arbitrary operating system command execution via a crafted HTTP request. It also details the specific firmware versions affected and the corresponding patched versions for various Zyxel GS1900 models. Furthermore, the article introduces a separate, actively exploited vulnerability in Veeam Agent for Windows (CVE-2026-32996), which enables local privilege escalation to SYSTEM-level control.
The new article provides further detail on the exploitation mechanism, describing how an unauthenticated local attacker can send a specially crafted HTTP request to a vulnerable Zyxel GS1900 Series Switch. Successful exploitation allows for the execution of operating-system commands, enabling threat actors to monitor traffic, alter network settings, or move laterally within an environment. Additionally, it highlights CISA's directive for forensic triage, indicating that remediation should extend beyond simple patching to include investigations for unauthorized access and suspicious activity.
The new article reveals that a Chinese threat actor has been actively exploiting CVE-2026-7273 since August, targeting 996 ZyXEL GS1900 switches across 48 countries for data exfiltration. The attackers used a Python script to steal hashed credentials and configuration data, with a notable portion of compromised devices still using default credentials. This exploitation campaign predates the CISA KEV addition and highlights the rapid pace at which vulnerabilities are being weaponized.
This new report from Help Net Security details the specific threat actor behind the exploitation of CVE-2026-7273, identifying them as a Chinese-speaking group previously linked to attacks on WordPress and Gitea instances. The article further elaborates on the obfuscation techniques used in the exploit script and provides more granular details on the types of data exfiltrated, including hashed root-level credentials from nearly 1000 compromised Zyxel GS1900 switches across 48 countries.