CISA Orders Federal Agencies to Patch Actively Exploited Zyxel GS1900 Flaw by September 24

The U.S. Cybersecurity and Infrastructure Security Agency added a high-severity Zyxel switch vulnerability to its Known Exploited Vulnerabilities catalog on Monday, September 21, 2026, after evidence emerged that attackers are using the flaw to steal data from networks worldwide. The vulnerability, tracked as CVE-2026-7273, affects Zyxel GS1900 series switches and carries a CVSS 3.1 base score of 8.8. CISA issued the addition with a clear operational demand: federal civilian executive branch agencies must apply mitigations or patches by Thursday, September 24, 2026, under Binding Operational Directive 26-04.

The underlying defect is a stack-based buffer overflow, classified as CWE-121, in a CGI program within the GS1900 firmware. According to Zyxel, an unauthenticated attacker on the local area network can exploit the flaw through a crafted HTTP request and execute operating system commands. The CVSS vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects that the attacker needs adjacent network access, no privileges, and no user interaction, while the impact on confidentiality, integrity, and availability is high.

Zyxel released a firmware update for the issue on June 16, 2026, and recommended that customers upgrade to receive the best protection. Ten GS1900 models are affected, including the GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48, and GS1900-48HPv2. The vulnerable firmware versions run up to 2.90(AAHH.1)C0 and earlier for the GS1900-8, with fixed builds such as 2.90(AAHH.2)C0; other model families carry their own firmware identifiers, including AAHI, AAZI, AAHJ, AAHL, AAHK, ABTO, ABTP, AAHN, and ABTQ.

Threat intelligence firm GreyNoise reported that a malicious cyber actor believed to be Chinese-speaking has been weaponizing CVE-2026-7273 since August 17, 2026. On September 17, 2026, GreyNoise recorded the first publicly documented in-the-wild exploitation of the flaw. The actor successfully compromised and stole sensitive data from 996 Zyxel switches across 48 countries, according to GreyNoise. The affected countries include Italy, the United States, Taiwan, France, and South Korea. Zyxel had not updated its advisory to confirm active exploitation as of the reporting, even though CISA had already moved the CVE into its exploited list.

Key Facts

BleepingComputer reported on September 22, 2026, that CISA ordered federal agencies to patch the Zyxel flaw by Thursday because attackers are actively exploiting it for data theft. The publication said the vulnerability stems from a stack buffer overflow in a CGI program and lets an unprivileged LAN attacker run operating system commands through a malicious HTTP request. BleepingComputer also noted that Zyxel shipped its fix on June 16, 2026, and that the vendor recommended firmware upgrades.

The Hacker News reported on September 22, 2026, that CISA added CVE-2026-7273 to the KEV catalog based on evidence of active exploitation. The report put the CVSS score at 8.8 and described the bug as a stack buffer overflow leading to arbitrary operating system command execution. It also connected the campaign to GreyNoise findings: the suspected Chinese-speaking actor weaponized the flaw from August 17, 2026, and stole data from 996 switches in 48 countries. The stolen information included configurations, root credential hashes, and network information.

CISA said in its September 21, 2026, alert that such vulnerabilities are common attack vectors for malicious cyber actors and pose a significant risk to the federal enterprise. The agency explained that Binding Operational Directive 26-04 establishes risk-based vulnerability management requirements for federal civilian executive branch agencies. Under that directive, agencies must prioritize and rapidly remediate high-risk vulnerabilities, especially CVEs listed in the KEV catalog that sit on publicly exposed assets and grant full control of the asset if exploited. CISA added that BOD 26-04 requires agencies to check whether systems have already been compromised by threat actors before patching.

DeafNews reported on September 22, 2026, that the KEV addition and the September 24 federal deadline turned the Zyxel flaw from routine vulnerability management into an urgent incident. The report noted that the flaw is in the firmware CGI program of GS1900 models and that 10 models are confirmed vulnerable, with affected firmware up to version 2.90. DeafNews also emphasized that administrators should verify the exact switch model and installed firmware rather than relying only on the GS1900 series name, because firmware naming varies by model and a device can remain vulnerable when the major version appears current but the final build is not updated.

GreyNoise said the exploitation code is a Python script heavily obfuscated with the commercial tool PyArmor. The script explicitly targets GS1900-24 firmware versions 2.10 through 2.90, but it offers command line options such as libc base address and global offset to target other firmware within the vulnerability scope. The actor used the flaw to run TFTP, the trivial file transfer protocol, to fetch and run a custom collection script. The data taken included configuration data, hashes of root-level credentials, and network details.

Analysis

The bigger picture here is that CVE-2026-7273 is not a single product bug story but a campaign pattern that links edge devices, backup systems, and web applications into one operational problem. Zyxel GS1900 switches are often deployed as the default equipment that internet service providers hand to customers with new broadband contracts, which puts them in millions of small business, branch office, and home office networks. That placement makes a LAN-side flaw more dangerous than its access vector first suggests. An attacker who already has a foothold on an endpoint, a wireless network, or a flat internal network can reach the switch management interface and turn the device into a command execution platform.

The Hacker News reported that the same threat actor has been observed exploiting UniFi OS, Flowise, WordPress, the Linux kernel flaw CVE-2022-0847, Nuclio, SENAITE LIMS, Proxmox VE, and an unspecified Palo Alto Networks PAN-OS GlobalProtect portal vulnerability. The actor also overlaps with a cluster that Acronis disclosed and named Red Heron, which abused a newly disclosed Gitea flaw, CVE-2026-60004, to compromise internet-facing instances. This is a broad, multi-product exploitation strategy, not an opportunistic scan against one vendor. What this really means is that defenders cannot treat the Zyxel KEV entry as an isolated patch ticket. The same actor is probing several layers of the same environments, and a switch compromise can provide the configuration and credential material needed to move deeper.

The data theft details add another dimension. GreyNoise said the stolen data included root-level credential hashes and network information from 996 switches in 48 countries. Credential hashes from network devices can enable lateral movement, credential reuse attacks, or further manipulation of routing and segmentation. The use of a PyArmor-obfuscated Python script and TFTP-based payload retrieval shows a repeatable toolchain rather than a one-off exploit. The script's command line options for libc base address and global offset indicate that the actor can adapt the exploit to firmware versions beyond the explicitly targeted GS1900-24 builds. The campaign therefore has both scale and flexibility.

Arctic Wolf separately warned about CVE-2026-32996, a local privilege escalation flaw in Veeam Agent for Microsoft Windows with a CVSS score of 7.3. That bug involves the Veeam Endpoint Backup service and its handling of an elevated client session on the local gRPC named pipe. The service caches an elevated administrator principal to a session UID controlled by the client and not bound to the requesting user or connection. Because the elevated session UID is written to log files that standard users can read, an attacker can obtain a valid UID and use it to execute commands with SYSTEM privileges. DeafNews framed the two flaws as targeting different infrastructure layers: the internal network boundary and the disaster recovery path. The combination matters because recovery infrastructure is often assumed to be trusted and isolated.

Why It Matters

The federal deadline is September 24, 2026, which gives agencies only three days from the September 21 KEV addition to verify exposure, patch or mitigate, and check for compromise. BOD 26-04 does not treat patching as the only duty. CISA's alert states that agencies must check whether threat actors have already compromised systems before remediation. For a switch vulnerability, that means looking for unauthorized configuration changes, unexpected TFTP activity, anomalous outbound connections, and signs that credential material was accessed or exfiltrated. A rapid firmware upgrade without a compromise assessment could leave an attacker's access in place.

The scale reported by GreyNoise is significant: 996 switches in 48 countries, with data theft that includes root credential hashes and network information. Zyxel says its networking solutions are used by more than one million businesses in 150 markets. CISA currently tracks 13 vulnerabilities affecting Zyxel routers, switches, firewalls, and NAS devices. Those numbers explain why the agency moved quickly. A widely deployed switch family with a LAN-reachable command execution flaw creates a large attack surface, especially in environments where network devices are not regularly updated or where firmware build numbers are not carefully tracked.

The addition also reflects a broader pattern in vulnerability management. CISA added only one KEV entry on September 21, 2026, and it was CVE-2026-7273. The agency encourages all organizations, not just federal agencies, to adopt risk-based vulnerability management and prioritize KEV-listed flaws. The Veeam issue reported by Arctic Wolf shows that the same week brought another actively exploited flaw with maximum-privilege consequences. Organizations that focus only on internet-facing systems may miss the internal and recovery layers that these campaigns now target.

Next Up

Administrators should identify the exact GS1900 model and installed firmware version before applying updates, because the affected and fixed builds differ across the ten models. Zyxel's fixed firmware versions include 2.90(AAHH.2)C0 for the GS1900-8 and corresponding updates for the other model identifiers. Organizations should also review switch logs for TFTP activity, unexpected script execution, configuration changes, and outbound connections that could indicate data collection. Where compromise is suspected, CISA's guidance under BOD 26-04 calls for checking systems for threat actor presence before patching, and for treating the device as potentially untrusted until it is cleaned and rebuilt.

Federal agencies face the September 24, 2026 deadline, and other organizations should expect continued attention on the Zyxel GS1900 series as more details emerge. The Veeam Agent for Microsoft Windows flaw CVE-2026-32996, reported by Arctic Wolf, is another active exploitation case that administrators should track alongside the Zyxel KEV entry. CISA said it will continue adding vulnerabilities that meet its criteria and welcomes nominations for exploited flaws that are not yet listed. The practical next step is to prioritize the KEV entry, verify firmware, hunt for compromise, and close the internal network and recovery gaps that this campaign has exposed.