Loading story…
CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a critical stack-based buffer overflow in Zyxel GS1900 Series Switches. The flaw resides in the switches' CGI program and allows an unauthenticated attacker on the local network to send a crafted HTTP request and potentially execute operating-system commands.
Federal agencies must remediate the issue by September 24, 2026, under Binding Operational Directive 26-04; CISA also requires forensic triage. Organizations should apply Zyxel's mitigations, restrict switch-management interfaces to trusted administrative networks, assess exposed devices, and review switches and logs for compromise indicators. Organizations unable to mitigate the vulnerability should discontinue use of affected devices; ransomware-campaign use is currently unknown.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
CISA released KEV Catalog version 2026.09.21 and added CVE-2026-7273, a stack-based buffer overflow in the CGI program of Zyxel GS1900 Series Switches. The catalog records active exploitation; a local unauthenticated attacker can use a crafted HTTP request to potentially execute operating-system commands, and CISA marked the issue for forensic triage.
Zyxel released firmware updates that remediate CVE-2026-7273 across ten GS1900 Series switch models. The fixes update affected 2.90 firmware branches to their corresponding .2 builds.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zyxel has released firmware updates for **CVE-2026-7273**, a stack-based buffer overflow in the CGI component of **GS1900 series** switch firmware that can let a LAN-based, unauthenticated attacker send a crafted HTTP request and potentially execute operating system commands on affected devices. The flaw carries a **CVSS 8.8** rating and is classified as **`CWE-121`**, with impact to confidentiality, integrity, and availability; public references specifically note exposure in models across the GS1900 line, including devices such as the **GS1900-8**, **GS1900-24**, **GS1900-48HPv2**, and other units running firmware **2.90 or earlier** in their respective branches.
Jun 29, 2026
Researchers and defenders warned that two critical zero-day vulnerabilities in Zyxel CPE devices, `CVE-2024-40890` and `CVE-2024-40891`, are being actively exploited in the wild. The flaws affect Zyxel CPE models that are now end-of-life and can enable command injection leading to full device compromise; reporting from GreyNoise highlighted active exploitation of `CVE-2024-40891`, while CSIRT.SK said Mirai-based botnet variants have been observed abusing the issue. The exposed devices appear to be attractive initial-access targets because they sit at the network edge and can be conscripted into botnets or used as footholds into victim environments. Zyxel is not expected to issue patches for the affected hardware, leaving organizations to mitigate by replacing vulnerable devices, restricting access to administrative interfaces, and increasing monitoring of HTTP and Telnet traffic for signs of exploitation and post-compromise activity.
Jul 24, 2026
Zyxel's **WAH7601** portable 4G router is affected by a set of four vulnerabilities, including the critical unauthenticated OS command injection flaw **`CVE-2026-13206`** and the high-severity credential exposure issue **`CVE-2026-12984`**. According to TR-CERT advisory **`TR-26-0799`**, all four flaws affect firmware through build **`20072026`**. The command injection bug is remotely exploitable and carries a **CVSS 9.8** score, while the credential issue, scored **CVSS 8.2**, can allow unauthorized retrieval of embedded sensitive data. The reported impact includes **root-level remote code execution**, credential theft, traffic interception, persistence on the device, and possible pivoting into internal networks after compromise. Public reporting said no active exploitation had been observed, but also noted that the vulnerabilities were **unpatched** at disclosure time. Recommended defenses include updating to the latest firmware if available, applying any vendor fixes, restricting or removing internet exposure of the management interface, strengthening access credentials, and replacing the device if access cannot be adequately controlled.
Aug 11, 2026