The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a stack-based buffer overflow in Zyxel's GS1900-series switches to its Known Exploited Vulnerabilities (KEV) catalog, confirming the flaw is being actively abused in the wild.
What happened
The vulnerability, tracked as CVE-2026-7273 (CVSS 8.8), sits in the CGI component of the GS1900 switch firmware. An unauthenticated attacker can send a crafted HTTP request and execute arbitrary operating system commands on the device. Zyxel patched the issue across its GS1900 line back in June 2026, but a large number of devices were never updated.
According to researchers at GreyNoise, a suspected Chinese-speaking threat cluster has been exploiting the flaw since mid-August 2026, compromising nearly 1,000 Zyxel switches across 48 countries, with Italy, the United States, Taiwan, France and South Korea among the most affected. The attackers use the exploit to trigger the device's built-in TFTP client, pulling down a heavily obfuscated Python collector script that harvests configuration files, hashed root credentials, and internal network topology data.
The same actor cluster — also linked to a recent Gitea exploitation campaign tracked as "Red Heron" — has reportedly been observed hitting a wider set of internet-facing products, including UniFi OS, WordPress, Flowise, older Linux kernels (via the Dirty Pipe flaw), Proxmox VE, SENAITE LIMS, and an as-yet-unpatched issue in Palo Alto Networks' GlobalProtect portal. Zyxel has credited the researchers who reported the original bug but has not independently confirmed active exploitation. Under CISA's directive, U.S. federal civilian agencies must apply the fix by September 24, 2026.
A second front: Veeam Agent for Windows
Separately, researchers at Arctic Wolf disclosed active exploitation of CVE-2026-32996 (CVSS 7.3), a local privilege-escalation vulnerability in Veeam Agent for Microsoft Windows. The bug lives in how the Veeam Endpoint Backup service manages elevated client sessions over a local named pipe. The service caches an elevated administrator session identifier that isn't tied to the specific user or connection that requested it — and that identifier is written in plain sight to a log file any standard user can read.
An attacker with local, low-privileged access can read that log, lift a valid elevated session UID, and reuse it to run commands as SYSTEM. A public proof-of-concept already demonstrates the technique.
Why it matters
Both cases illustrate how quickly disclosed vulnerabilities are turning into working exploitation campaigns — weeks, not months, after a patch ships. Network switches and backup agents are particularly attractive targets: they typically sit outside standard endpoint monitoring, run with elevated trust, and — in the Zyxel case — offer attackers a single shot at both durable access and credential harvesting.
What to do
- Update all Zyxel GS1900-series switches to the fixed firmware immediately if you haven't already.
- Apply the Veeam update addressing CVE-2026-32996 on any host running Veeam Agent for Windows.
- Restrict switch management interfaces to trusted internal networks only, and disable remote HTTP/CGI access where it isn't required.
- Hunt for indicators of compromise: unexpected outbound TFTP sessions from network switches, unfamiliar processes on backup-agent hosts, or unauthorized local administrator group changes.
- Treat privilege-escalation flaws in backup and endpoint-management software as high priority — this class of software typically runs with elevated trust across the whole environment.