Zyxel GS1900 series switches stack-based buffer overflow security flaw (CVE-2026-7273)
Vulnerability
Summary
Hide ▲
Show ▼
CVE-2026-7273 in Zyxel GS1900 series switches is now in CISA’s KEV catalog after evidence of active exploitation, putting affected networks at risk of arbitrary OS command execution via a crafted HTTP request.
Related Happenings
StormEncryptor ransomware deployment by Storm-1175
Malware Activity
H score40
First: 10.08.2026 20:42
Last: 10.08.2026 20:42
Sources 1
About this happening:
Storm-1175 is deploying StormEncryptor, a previously undocumented ransomware strain that appends .encrypted to encrypted files and drops !!!README_FIRST!!!.txt ran...
StormEncryptor ransomware deployment by Storm-1175
Malware ActivityAbout this happening: Storm-1175 is deploying StormEncryptor, a previously undocumented ransomware strain that appends .encrypted to encrypted files and drops !!!README_FIRST!!!.txt ran...
BRICKSTORM backdoor activity and GRIMBOLT replacement on appliances
Malware Activity
H score29
First: 18.02.2026 12:32
Last: 18.02.2026 12:32
Sources 1
About this happening:
BRICKSTORM is a Golang backdoor used by PRC state-sponsored actors to keep long-term persistence on VMware vSphere, Windows, and appliance environments. ...
BRICKSTORM backdoor activity and GRIMBOLT replacement on appliances
Malware ActivityAbout this happening: BRICKSTORM is a Golang backdoor used by PRC state-sponsored actors to keep long-term persistence on VMware vSphere, Windows, and appliance environments. ...
Timeline
-
22.09.2026 08:31 4 articles · 13d ago
CISA adds CVE-2026-7273 in Zyxel GS1900 switches to KEV after active exploitation
Initial DisclosureCISA added CVE-2026-7273 affecting Zyxel GS1900 series switches to the Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation. Zyxel said the stack-based buffer overflow in the CGI program of the switch firmware could let a LAN-based, unauthenticated attacker send a crafted HTTP request to execute OS commands, and the vendor had released fixes for GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48, and GS1900-48HPv2. Federal Civilian Executive Branch (FCEB) agencies were required to apply the fixes by September 24, 2026.
Show sources
- Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access — thehackernews.com — 22.09.2026 08:31
- Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access — thehackernews.com — 22.09.2026 08:31
- CISA orders feds to patch Zyxel flaw exploited for data theft — www.bleepingcomputer.com — 22.09.2026 11:53
- Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers — www.securityweek.com — 22.09.2026 14:55