GoKawiilCISA mandates federal patch for actively exploited Zyxel GS1900 switch flaw
CISA added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities catalog after confirming active attacks. The flaw allows unauthenticated LAN attackers to run OS commands via crafted HTTP requests, and federal agencies must secure affected devices by Thursday under Binding Operational Directive 26-04. Zyxel issued firmware fixes on June 16 but has not yet updated its advisory to acknowledge exploitation.
GoKawiil's interpretation of the reporting above, not reported fact.
Network switches sit at a critical chokepoint, so a remotely exploitable command-injection bug in widely deployed hardware gives attackers a foothold to pivot deeper into enterprise and government networks. CISA's binding deadline for federal agencies signals the urgency, and the warning to all organizations underscores that this class of flaw is a common, repeatable attack vector beyond just Zyxel gear.
- CVE-2026-7273 is a buffer overflow letting unauthenticated attackers run commands on Zyxel GS1900 switches.
- CISA has confirmed active exploitation and given federal agencies until Thursday to patch.
- Zyxel released firmware updates in June but hasn't yet confirmed exploitation in its own advisory.
Zyxel GS1900-24 Managed Switch — If you're running an older Zyxel GS1900 switch affected by this actively exploited vulnerability, upgrading to a current-generation managed switch with the latest firmware support is a smart move. The GS1900 series offers easy web-based management and VLAN support, making it a solid choice for securing your local network once properly patched and configured.
See Zyxel GS1900-24 Managed Switch on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-22
Published there as: “CISA orders feds to patch Zyxel flaw exploited for data theft”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.