Active Attacks Put Zyxel Switches and Veeam-Protected Windows Endpoints at Risk

Two security flaws are drawing urgent attention because they can give attackers powerful control over network infrastructure and Windows endpoints.

CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 series switches, enables an unauthenticated attacker on an adjacent network to potentially execute operating-system commands. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 21, 2026, citing evidence of active exploitation.

A separate issue, CVE-2026-32996, affects Veeam Agent for Microsoft Windows. It allows an attacker who already has local access to elevate privileges to SYSTEM by reusing elevated session identifiers exposed through a readable service log.

The Zyxel flaw carries a CVSS v3 score of 8.8. A score of 7.3 has been reported for the Veeam vulnerability, although the available NVD information does not include its full vector.

Zyxel’s CGI handler can turn a crafted request into command execution

CVE-2026-7273 is classified as a stack-based buffer overflow under CWE-121. It resides in the CGI program used by firmware for Zyxel GS1900 series switches.

An attacker does not need credentials or user interaction. However, the attacker must be able to reach the device from an adjacent network, such as a LAN or another segment with access to the switch’s management service.

A specially constructed HTTP request can trigger the overflow and potentially lead to arbitrary operating-system command execution. Its vector is:

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This reflects low attack complexity, no privilege requirement and high potential impact across confidentiality, integrity and availability. Exploitation does not cross a security scope boundary, but control of a switch can still affect systems and traffic beyond the device itself.

Depending on the service privileges and network design, successful exploitation could let an attacker change configurations, interrupt connectivity or manipulate traffic. A compromised switch could also become a foothold for reaching adjacent systems or concealing further activity.

The identities of the attackers, the start of exploitation and the number of affected organizations are not known. CISA has also not described what intruders did after compromising vulnerable switches.

Zyxel reportedly credited Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu and Tianyue Luo of ISCAS with finding and reporting the vulnerability.

Ten GS1900 models require model-specific firmware updates

The NVD description explicitly identifies GS1900-48HPv2 firmware through 2.90(ABTQ.1)C0 as vulnerable. Vendor information also provides affected and corrected releases for ten GS1900 variants:

Product	Affected firmware	Fixed firmware
GS1900-8	2.90(AAHH.1)C0 and earlier	2.90(AAHH.2)C0
GS1900-8HP	2.90(AAHI.1)C0 and earlier	2.90(AAHI.2)C0
GS1900-10HP	2.90(AAZI.1)C0 and earlier	2.90(AAZI.2)C0
GS1900-16	2.90(AAHJ.1)C0 and earlier	2.90(AAHJ.2)C0
GS1900-24	2.90(AAHL.1)C0 and earlier	2.90(AAHL.2)C0
GS1900-24E	2.90(AAHK.1)C0 and earlier	2.90(AAHK.2)C0
GS1900-24EP	2.90(ABTO.1)C0 and earlier	2.90(ABTO.2)C0
GS1900-24HPv2	2.90(ABTP.1)C0 and earlier	2.90(ABTP.2)C0
GS1900-48	2.90(AAHN.1)C0 and earlier	2.90(AAHN.2)C0
GS1900-48HPv2	2.90(ABTQ.1)C0 and earlier	2.90(ABTQ.2)C0

Administrators should verify both model and firmware branch rather than assuming that one build applies across the product family.

No additional Zyxel workaround has been disclosed. The available remediation is to install the fixed firmware corresponding to each model. Zyxel’s alert had reportedly not been updated to acknowledge active exploitation, despite CISA’s separate determination that exploitation evidence justified a KEV listing.

CISA sets a September 24 federal remediation deadline

CISA added CVE-2026-7273 to the KEV catalog on September 21, 2026. U.S. Federal Civilian Executive Branch agencies must complete remediation by September 24, 2026.

The catalog records ransomware use as unknown. It also requires forensic triage under BOD 26-04, “Prioritizing Security Updates Based on Risk.”

Federal agencies must apply vendor mitigations, assess each asset’s internet exposure and follow CISA’s forensic-triage requirements. Where mitigations are unavailable, the directive calls for discontinuing use when applicable. Other organizations are not bound by the federal deadline, but the KEV designation provides a concrete reason to prioritize the issue.

Installing new firmware addresses the vulnerable software but does not establish whether an attacker reached the switch beforehand. That distinction matters because CISA is requiring investigation, not patching alone.

Organizations should preserve relevant logs and configuration data before making changes when compromise is suspected. Investigators should examine management activity for anomalous HTTP requests, unexplained administrative operations, configuration or firmware changes, and unexpected reboots. They should also review systems accessible from the switch-management network for activity that may have originated there.

Veeam session identifiers expose a path from local user to SYSTEM

CVE-2026-32996 follows a different attack model. It is a local privilege-escalation flaw in Veeam Agent for Microsoft Windows, rather than a remotely reachable network-device vulnerability.

The issue involves the Veeam Endpoint Backup service and its local gRPC named pipe:

\\.\pipe\Veeam\VAW\ServiceConnectionPipe

The service links an elevated administrator principal to a client-controlled session UID. That identifier is not sufficiently bound to the user or connection that originally obtained it.

Elevated session UIDs are subsequently written to the following log:

C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log

Standard users can read the file. An attacker with local access can recover a valid elevated UID from the log, present it to the service and execute commands with SYSTEM privileges.

This is not an initial remote-access mechanism. Instead, it can amplify a foothold obtained through a standard user account, malware execution, remote-access software or another vulnerability. SYSTEM control can support credential access, persistence, security-tool interference, lateral movement, data theft or encryption.

A public GitHub proof of concept demonstrates the escalation by running whoami and writing the command’s output to a file. The active-exploitation warning has been attributed to Arctic Wolf.

CVE-2026-32996 is not identified as a CISA KEV entry in the available information. Its affected-version range, fixed build, workaround, CWE classification and CISA remediation deadline are also not known.

Defenders should investigate exposure, not only vulnerable versions

For Zyxel environments, the immediate task is to inventory every GS1900 switch, record its precise model and firmware version, and apply the corresponding update. Devices reachable from guest, user, untrusted or internet-connected segments should receive priority.

Management access should be restricted to trusted administrative networks. Where a switch was exposed before patching, defenders should conduct forensic triage and inspect adjacent systems rather than treating the update as the end of the incident.

For Veeam deployments, administrators should identify every Windows endpoint running Veeam Agent and determine the installed release. Because no corrected build has been specified, organizations should obtain update information through Veeam’s official guidance when it becomes available.

Security teams should monitor access to Svc.VeeamEndpointBackup.log and suspicious interaction with ServiceConnectionPipe. Unexpected processes running as SYSTEM, service abuse, newly created accounts, security-control changes and persistence mechanisms warrant investigation.

Any Veeam endpoint showing evidence of successful exploitation should be handled as fully compromised. The privilege gained is not limited to the backup application; it grants control over the Windows system itself.