Cybersecurity
CISA orders federal agencies to patch Zyxel flaw
CISA added a Zyxel GS1900 vulnerability to its exploited list and told federal civilian agencies to remediate it, while GreyNoise said it had seen signs of data theft.
- CISA said attackers were actively exploiting CVE-2026-7273 in Zyxel GS1900 switches.
- Zyxel said it released updates on 16 June and advised customers to upgrade firmware.
- CISA added the flaw to its Known Exploited Vulnerabilities Catalog and told FCEB agencies to secure their switches by Thursday under BOD 26-04.
- GreyNoise said it first saw signs of exploitation last Thursday and said 996 switches in 48 countries had been compromised.
CISA said attackers were actively exploiting CVE-2026-7273 in Zyxel GS1900 switches. It said the flaw was a stack-based buffer overflow in the CGI program and could let a user on the local network run operating system commands through crafted HTTP requests.
Zyxel said it had released security updates on 16 June and told customers to upgrade firmware for better protection. The company had not yet updated its advisory to confirm active exploitation when CISA added the issue to its KEV Catalog on Monday.
CISA also ordered Federal Civilian Executive Branch agencies to secure their switches by Thursday under Binding Operational Directive 26-04. It said this kind of flaw was a common route for malicious actors and urged all organisations to prioritise remediation of KEV items.
GreyNoise said it had seen the first signs of exploitation last Thursday and described the case as the first publicly documented in-the-wild exploitation of the flaw. It said a suspected Chinese-speaking actor had compromised 996 Zyxel switches in 48 countries and taken sensitive data as part of a wider campaign against other vulnerabilities.
Named in this story
Companies
- Zyxel
- released updates and told customers to upgrade firmware
- GreyNoise
- said it first saw exploitation and later reported data theft
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency (CISA)
- added the flaw to the KEV Catalog and ordered agencies to act
- Federal Civilian Executive Branch (FCEB) agencies
- were told to secure their switches by Thursday
- Binding Operational Directive (BOD) 26-04
- set the federal remediation requirement
Products and systems
- Zyxel GS1900 series switches
- were the devices affected by the flaw
- CVE-2026-7273
- was the vulnerability said to be under active exploitation
- Known Exploited Vulnerabilities (KEV) Catalog
- was the list CISA used to trigger federal remediation
How the source tells it
The piece was mostly straight reporting, but official warnings and large counts gave it an urgent, cautionary tone.
- urgency a federal remediation deadline and ongoing-attack language
- alarm official warnings framed the flaw as a common attack route and a major risk
- scale emphasis the report leaned on near-1,000-device and 48-country counts