Attackers are actively exploiting CVE-2026-7273 in Zyxel GS1900 series switches, a high-severity stack-based buffer overflow that can let unauthenticated LAN users execute OS commands through malicious HTTP requests. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch affected devices, while GreyNoise reports nearly 1,000 compromised switches across 48 countries. #CVE-2026-7273 #ZyxelGS1900 #CISA #GreyNoise
Keypoints
- CISA says CVE-2026-7273 is being actively exploited in Zyxel GS1900 switches.
- The flaw is a stack-based buffer overflow in the CGI program.
- Attackers can execute OS commands through crafted HTTP requests from the LAN.
- Zyxel released patches on June 16 and urged firmware upgrades.
- GreyNoise reported nearly 1,000 compromised switches across 48 countries.