Actively Exploited Zyxel Switch Flaw Triggers Three-Day Federal Patch Window

The US Cybersecurity and Infrastructure Security Agency has ordered federal agencies to address a high-severity vulnerability in Zyxel GS1900-series switches after confirming exploitation in the wild.

CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on September 21, 2026. Federal Civilian Executive Branch agencies must complete the required remediation by September 24, 2026.

The flaw is a stack-based buffer overflow in the switches’ CGI component. An unauthenticated attacker with access to the local network can send a malicious HTTP request and potentially execute operating-system commands on the device.

Exploitation turns a high-severity flaw into an urgent threat

CVE-2026-7273 carries a CVSS v3.1 score of 8.8, rated High, with the following vector:

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The vector describes an attack that requires adjacent-network access but has low complexity. It needs neither authentication nor user interaction, and successful exploitation can have a high impact on confidentiality, integrity, and availability.

CISA’s KEV catalog update establishes that the vulnerability is being used in real attacks. However, the agency has not published payloads, technical artifacts, indicators of compromise, victim details, or an attribution.

Zyxel had not publicly updated its advisory to confirm active exploitation at the time of reporting. That creates a distinction between CISA’s confirmed exploitation finding and the vendor’s public position, but it does not change the federal remediation requirement.

The weakness is classified as CWE-121, a stack-based buffer overflow. NVD lists the record as “Not Scheduled,” meaning it is not currently prioritized for additional NVD enrichment. The CVSS score and vector come from Zyxel in its role as the CVE Numbering Authority, rather than from an independent NVD assessment.

A crafted HTTP request can reach the switch operating system

The vulnerable code resides in the CGI program included with Zyxel GS1900 firmware. CGI components process web requests and pass input to software running behind a device’s management interface.

In this case, specially constructed input can overflow a stack buffer. A successful attacker may then cross the boundary between the web-management component and the underlying operating system, gaining the ability to run commands.

No account is required. The attacker must nevertheless be on the same LAN or otherwise satisfy the CVSS “Adjacent Network” condition. That restriction makes CVE-2026-7273 less universally reachable than a conventional internet-wide vulnerability, but it does not make exploitation unlikely.

A compromised endpoint inside an organization could attack switch management services from the local network. Misconfigured remote-access systems, exposed management interfaces, or externally reachable HTTP services may also increase practical exposure. CISA specifically requires agencies to assess each asset’s internet reachability.

Command execution on a network switch could expose configuration or device data, permit unauthorized changes, and interrupt services that depend on the affected hardware. The CVSS assessment rates all three impact categories as High.

Ten GS1900 models require model-specific firmware

Although the NVD description highlights the GS1900-48HPv2, Zyxel’s affected-product data identifies ten vulnerable models. Each has its own firmware identifier and corresponding fixed build.

Product	Affected firmware	Fixed firmware
Zyxel GS1900-8	2.90(AAHH.1)C0 and earlier	2.90(AAHH.2)C0
Zyxel GS1900-8HP	2.90(AAHI.1)C0 and earlier	2.90(AAHI.2)C0
Zyxel GS1900-10HP	2.90(AAZI.1)C0 and earlier	2.90(AAZI.2)C0
Zyxel GS1900-16	2.90(AAHJ.1)C0 and earlier	2.90(AAHJ.2)C0
Zyxel GS1900-24	2.90(AAHL.1)C0 and earlier	2.90(AAHL.2)C0
Zyxel GS1900-24E	2.90(AAHK.1)C0 and earlier	2.90(AAHK.2)C0
Zyxel GS1900-24EP	2.90(ABTO.1)C0 and earlier	2.90(ABTO.2)C0
Zyxel GS1900-24HPv2	2.90(ABTP.1)C0 and earlier	2.90(ABTP.2)C0
Zyxel GS1900-48	2.90(AAHN.1)C0 and earlier	2.90(AAHN.2)C0
Zyxel GS1900-48HPv2	2.90(ABTQ.1)C0 and earlier	2.90(ABTQ.2)C0

Zyxel released these security updates on June 16, 2026. The vulnerability was credited to ISCAS researchers Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu, and Tianyue Luo.

Administrators should verify the complete firmware string rather than checking only whether a device runs version 2.90. The vulnerable and corrected releases share that top-level version number and differ in their model-specific build identifiers.

GreyNoise reports hundreds of compromised switches

GreyNoise reported observing public signs of exploitation and characterized the activity as coming from a suspected Chinese-speaking malicious cyber actor.

As of September 17, 2026, the company said the actor had successfully compromised and removed sensitive data from 996 Zyxel switches in 48 countries. The broader campaign reportedly attempted to exploit more than a dozen other vulnerabilities across multiple software and technology products.

Those figures and the actor characterization have not been independently detailed by CISA. The agency has neither attributed the activity nor confirmed the reported victim count publicly.

There are also no published, vulnerability-specific indicators that defenders can use for a simple signature search. No exploit code, malicious HTTP pattern, command sequence, destination address, file hash, or other artifact has been disclosed.

This limits retrospective detection. Organizations must instead examine device and network telemetry for anomalies such as unusual HTTP requests, unexpected administrative actions, unexplained configuration changes, command execution, sensitive-data access, and suspicious outbound transfers.

Patching should follow forensic triage, not replace it

CISA requires affected federal agencies to apply Zyxel’s mitigations while complying with Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, and the agency’s Forensics Triage Requirements.

The short remediation window means agencies need to identify every GS1900 device, record its model and running firmware, and install the corresponding corrected build. They must also evaluate internet exposure and follow the relevant BOD 26-04 provisions for cloud services.

Forensic review matters because installing new firmware may close the vulnerability without determining whether the switch was already compromised. Defenders should preserve available logs and configuration data before making changes where operationally feasible.

A practical response sequence is:

1. Inventory all GS1900 switches, including internally managed devices.
2. Record the exact model and full firmware build.
3. Assess whether HTTP management is accessible from untrusted networks.
4. Review device and surrounding network logs for suspicious activity.
5. Preserve relevant evidence if compromise is suspected.
6. Install the model-specific fixed firmware.
7. Validate configuration and service behavior after upgrading.
8. Discontinue use where the required mitigation cannot be applied.

The September 24, 2026 deadline is binding for affected FCEB agencies. Private organizations are not generally subject to that deadline, but a KEV listing provides a strong operational reason to prioritize the same fixes.

Zyxel has faced repeated KEV-listed exploitation

CVE-2026-7273 is not an isolated Zyxel entry. CISA currently tracks 13 exploited Zyxel vulnerabilities affecting switches, routers, firewalls, and network-attached storage products, according to the available reporting.

One earlier example is CVE-2024-40891, an 8.8-rated command-injection vulnerability associated with legacy Zyxel DSL customer-premises equipment. CISA added it to KEV on February 11, 2025, with a federal remediation deadline of March 4, 2025.

For that vulnerability, CISA warned that affected equipment might be end-of-life or end-of-service and directed users to stop using it when no current mitigation was available. Public product data for CVE-2024-40891 also contains a scope discrepancy: the affected-product list and the NVD narrative identify different Zyxel device families.

The current GS1900 case is more straightforward because fixed firmware is available for all ten listed models. The immediate task is therefore clear: check the exact build, look for evidence of prior access, and install the corresponding update.