CISA Orders Federal Agencies to Patch a Zyxel Flaw That Already Compromised Nearly 1,000 Switches

The U.S. Cybersecurity and Infrastructure Security Agency added a Zyxel switch vulnerability to its Known Exploited Vulnerabilities catalog on Monday, giving federal civilian agencies until Thursday, September 24, to patch it under Binding Operational Directive 26-04. The flaw, tracked as CVE-2026-7273, is a stack-based buffer overflow in the CGI program of Zyxel’s GS1900 series smart managed switches, and Zyxel shipped a fix for it back in June. What makes the deadline urgent is not the patch timeline. It is a separate finding from threat intelligence firm GreyNoise, published this month: a single attacker had already exploited the bug to pull data out of nearly 1,000 of these switches, spread across 48 countries, weeks before CISA’s public listing existed.

What the Flaw Actually Does

Zyxel’s own advisory describes the vulnerability plainly: a crafted HTTP request to the switch’s CGI program can trigger a stack-based buffer overflow, letting an attacker who is already on the local network, but who needs no login credentials, execute operating system commands on the device. The National Vulnerability Database scores it 8.8 out of 10 (CVSS 3.1, high severity), with an attack vector of “adjacent network” rather than fully remote over the internet: the attacker needs LAN access, not internet-wide reach, but once they have it, no password or user interaction stands in the way. The bug falls under CWE-121, the standard weakness category for stack-based buffer overflows, and CISA’s own risk assessment, published through the National Vulnerability Database, rates its technical impact as total.

Ten specific GS1900 models are affected: the GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48, and GS1900-48HPv2, each on firmware versions Zyxel numbers 2.90 with a model-specific build suffix. Zyxel’s advisory, posted June 16, tells customers to upgrade to the fixed 2.90 build for their specific model “for optimal protection.” As of this week, Zyxel had not updated that advisory to acknowledge that the flaw is now being exploited.

A Campaign That Started Weeks Before the Public Warning

The exploitation evidence comes from GreyNoise’s Global Observation Grid, a network of sensors the company uses to watch attacker scanning and exploitation happen against infrastructure it controls, rather than waiting for a victim to notice and report an intrusion. In a research report published this month, GreyNoise says it has watched the underlying IP address scan and attack its sensors for years, but only became confident, based on a consistent set of tools, infrastructure, and Chinese-language code comments, that the activity from May 7 onward belongs to a single malicious cyber actor. The company suspects, based on code patterns and how little the underlying logic changed between rapid tool revisions, that the actor used a large language model to help write its custom scripts, though it says it did not identify a specific AI tool in use.

According to GreyNoise, that actor exploited CVE-2026-7273 on or about August 17, roughly five weeks before CISA’s KEV listing, to pull configuration files, hashed root-level credentials, and networking information out of 996 Zyxel GS1900 switches in 48 countries. The exploit itself was written in Python and wrapped in commercial obfuscation software called PyArmor. GreyNoise says it was able to reverse that obfuscation in part because the attacker left an old, pinned PyArmor runtime, version 6.7.5 from 2021, sitting inside the deployed tooling. GreyNoise calls this the first publicly documented case of exploitation in the wild for this specific vulnerability, and notes that as of its report, CVE-2026-7273 had not yet been added to CISA’s KEV catalog. That changed on Monday.

One Actor, Many Targets

The Zyxel intrusion was one entry on a longer list GreyNoise attributes to the same actor across roughly four months. The company’s published timeline also includes a June attempt against Ubiquiti UniFi OS using three chained vulnerabilities, a July exploit against a FlowiseAI flaw, a pair of WordPress vulnerabilities used to compromise a government website and steal more than 18,000 sensitive records, the well-known “Dirty Pipe” Linux kernel bug, and more recent activity against Nuclio, SENAITE LIMS, and Proxmox VE. GreyNoise links the actor, at least provisionally, to a group it calls “Red Heron,” previously reported on by security firm Acronis, based on a shared command-and-control domain, malware family, and matching tactics.

One entry on that timeline lines up with a story sxz.io already covered: on July 30, per GreyNoise, the same actor exploited the Gitea code injection flaw, CVE-2026-60004, that CISA added to its KEV catalog on August 25 after a separately reported cryptojacking incident on a self-hosted Gitea instance. GreyNoise’s report does not claim that incident and this actor’s activity are the same intrusion; the more likely read is that the flaw drew more than one opportunistic attacker once exploit details became public, which is itself a useful reminder that a single KEV listing can represent multiple, unrelated attackers converging on the same weakness. None of the broader campaign GreyNoise describes is mentioned in CISA’s Zyxel KEV entry or in Zyxel’s own advisory, which still frames the update as routine.

A Familiar Pattern for Zyxel

This is not an isolated incident for the vendor. CISA currently tracks 13 separate Zyxel vulnerabilities, spanning the company’s routers, switches, firewalls, and network-attached storage devices, that have been or still are being exploited in the wild. In February, Zyxel told customers it had no plans to patch a pair of actively exploited zero-day bugs affecting end-of-life routers that were still available for sale through third-party retailers, advising them to replace the hardware instead. Part of the exposure is structural: Zyxel says more than a million businesses across 150 markets use its networking gear, and internet service providers in many countries hand out Zyxel routers and switches as default, out-of-the-box equipment for new subscribers, which puts a large and often unmanaged installed base at the network edge.

For now, the fix for CVE-2026-7273 is straightforward: update affected GS1900 switches to the patched 2.90 firmware Zyxel released in June. The harder problem, visible in GreyNoise’s research, is how much quiet exploitation can happen against unmanaged network hardware before a government advisory or a vendor’s own bulletin catches up to it.

Sources

• BleepingComputer: CISA orders feds to patch Zyxel flaw exploited for data theft
• CISA: Known Exploited Vulnerabilities Catalog, CVE-2026-7273
• Zyxel Security Advisory: Stack-Based Buffer Overflow in GS1900 Series Switches
• GreyNoise: Open Season on Kapibala, Attacker Steals Over 18,000 Government Records Through WordPress Exploitation
• NVD: CVE-2026-7273 Detail

Image credit: Two Zyxel Dimension ES-105 Ethernet switches with power adapters, a different and older Zyxel switch model than the GS1900 series affected by CVE-2026-7273. Photo by Dash 7, licensed under CC BY-SA 3.0 via Wikimedia Commons; cropped and converted to WebP for sxz.io.