CVE-2026-7273
Allows unauthenticated OS command execution on Zyxel GS1900 switches
A buffer overflow vulnerability in the web management interface of Zyxel GS1900 series switches lets unauthenticated attackers execute operating system commands. The flaw is actively exploited, with nearly 1,000 devices compromised across 48 countries. Zyxel has released security updates to address the vulnerability.
Zyxel GS1900-48HPv2 firmware · Updated 4 Nov · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 21 Sept; US agencies must fix by 24 Sept
SeverityhighCVSS 8.8 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Apply the firmware update released by Zyxel for the GS1900 series switches. If updating is not possible, restrict network access to the web management interface to trusted hosts. Monitor for signs of compromise.
What happened
- 21 SeptCISA adds the Zyxel GS1900 vulnerability to its known-exploited list.
- 24 SeptUS federal agencies must apply a fix for the vulnerability by this date.
- 4 NovZyxel releases security updates after GreyNoise reports 996 devices compromised across 48 countries.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | high 8.8 | 21 Sept | 2.8% |
Our reporting
4 NovZyxel patches zero-day exploited to hack nearly 1,000 network switchesReported elsewhere
BleepingComputer · 4 NovZyxel fixes zero-day exploited to hack nearly 1,000 network switches ↗The records
zyxel.com: advisory ↗CISA known-exploited catalog ↗CVE-2026-7273 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free