CISA adds Zyxel GS1900 switch stack-based buffer overflow CVE-2026-7273 to KEV catalog on evidence of active exploitation

Linha do tempo

1. cisa.gov ↗ · pub. 21/09/2026 09:00 · coletado 19/10 18:37 primeiro registro

   CISA adds Zyxel GS1900 switch stack-based buffer overflow CVE-2026-7273 to KEV catalog on evidence of active exploitation

   ler a análise desta fonte ocultar

   CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-21 based on evidence of active exploitation: CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 Series Switches. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. The alert gives no technical details, affected firmware versions, exploitation specifics or attribution.

   The alert also references BOD 26-04, which requires FCEB agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control after exploitation. It further sets expectations for checking whether threat actors compromised a system before the patch was applied. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.

   Technical Details

   • CVE-2026-7273: Zyxel GS1900 Series Switches, stack-based buffer overflow vulnerability.
   • The article does not name affected firmware versions, exploitation methods, IOCs or threat actors.

   Remediation

   • Prioritize remediation of CVE-2026-7273 on Zyxel GS1900 switches, especially those that are publicly exposed.
   • Consult the Zyxel vendor advisory for affected versions and patches; the CISA alert does not list them.
   • Per BOD 26-04, check whether systems were compromised before the patch was applied.