CISA orders federal fix for exploited Zyxel switch flaw by Sep 24

CISA added CVE-2026-7273, a stack-based buffer overflow in the CGI component of Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities catalog on 21 September 2026. The vulnerability, rated CVSS 8.8, lets an unauthenticated attacker on the local network send a crafted HTTP request to run operating-system commands on the switch. Under Binding Operational Directive 26-04, US federal civilian agencies must remediate it by 24 September 2026 — a deadline that applies to federal agencies, not to every organization running the affected hardware.

Already under active exploitation

CISA's catalog addition follows reporting that a suspected Chinese-speaking actor has been exploiting the flaw since 17 August 2026, compromising nearly 1,000 Zyxel switches across 48 countries, including the United States, Italy, Taiwan and France. According to that reporting, the attacker used the exploit to run a TFTP client, pull down an obfuscated Python collector script, and exfiltrate device configuration data and hashed root-level credentials. Roughly 560 of the compromised devices reportedly still had factory-default credentials, which the flaw's severity does not depend on but which makes follow-on compromise easier.

Affected models and fix

The advisory covers the GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2 models. Zyxel shipped fixed firmware for the affected line in June 2026; applying it is the only complete remediation, since the flaw sits in the switch's management CGI rather than in a setting that can simply be disabled.

What MSPs should do this week

• Inventory every GS1900 switch across customer sites, noting firmware version and whether management access is reachable from outside a trusted admin VLAN.
• Apply the Zyxel-supplied firmware update rather than relying on network-level mitigations alone.
• Restrict HTTP management on these switches to a dedicated admin VLAN, and change any factory-default credentials immediately.
• Treat any device found already exploited as compromised: rotate credentials and rebuild from known-good firmware rather than assuming a patch alone clears an active infection.

The federal deadline is a floor, not a ceiling — with active exploitation already documented against nearly 1,000 devices, any organization running GS1900 switches has reason to patch on the same timeline.

Sources: CISA — KEV catalog addition, 21 September 2026, The Hacker News — Zyxel flaw under active exploitation.