Cybersecurity
CISA flags Zyxel flaw; Arctic Wolf reports Veeam exploitation
CISA added a patched Zyxel switch vulnerability to its exploited-flaws list after evidence of abuse, and Arctic Wolf said a separate Veeam Agent for Microsoft Windows bug was under attack.
- CISA added CVE-2026-7273 affecting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities list after citing evidence of active exploitation.
- Zyxel said the flaw was a stack-based buffer overflow in switch firmware that could let a LAN-based, unauthenticated attacker execute OS commands.
- Zyxel credited Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu and Tianyue Luo of ISCAS for discovering and reporting the issue.
- Federal Civilian Executive Branch agencies were required to apply the Zyxel fixes by 24 September 2026.
- Arctic Wolf said CVE-2026-32996 in Veeam Agent for Microsoft Windows could let a local attacker obtain SYSTEM-level control through the Veeam Endpoint Backup service and readable log data.
CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities list after saying it had evidence that the issue was being used in the wild. The bug affected Zyxel GS1900 series switches and could allow OS command execution on the device.
Zyxel said in June 2026 that the weakness was in the firmware’s CGI component and could be reached by an attacker on the local network without authentication using a crafted HTTP request. It listed fixed releases for the affected GS1900 models.
The company credited Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu and Tianyue Luo of ISCAS for finding and reporting the flaw. It had not updated its notice to confirm exploitation at the time of publication.
CISA said Federal Civilian Executive Branch agencies had to install the Zyxel remediation by 24 September 2026. Arctic Wolf separately said CVE-2026-32996 in Veeam Agent for Microsoft Windows was under active exploitation.
Arctic Wolf said the Veeam Endpoint Backup service handled elevated sessions in a way that let a client-controlled identifier be reused. It said readable log entries exposed those identifiers, and a public proof of concept showed commands running as SYSTEM.
Named in this story
People
- Lei Gu
- was credited with finding and reporting the Zyxel issue
- Jun Cao
- was credited with finding and reporting the Zyxel issue
- Zhiqing Rui
- was credited with finding and reporting the Zyxel issue
- Jingzheng Wu
- was credited with finding and reporting the Zyxel issue
- Tianyue Luo
- was credited with finding and reporting the Zyxel issue
Companies
- Zyxel
- issued the advisory and fixed the switch firmware
- Arctic Wolf
- warned of active exploitation of the Veeam flaw
Organisations
- ISCAS
- was credited with finding and reporting the Zyxel issue
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- added the Zyxel flaw to its exploited-vulnerabilities list
- Federal Civilian Executive Branch (FCEB) agencies
- were required to apply the Zyxel fix by 24 September 2026
Products and systems
- GS1900 series switches
- were the affected Zyxel devices
- Veeam Agent for Microsoft Windows
- had a local privilege-escalation flaw affecting endpoints
- Veeam Endpoint Backup service
- handled sessions in the way described by Arctic Wolf
How the source tells it
The article was largely factual, with urgency coming from the repeated emphasis on active exploitation and mandatory remediation dates.
- urgency active-exploitation references and a fixed remediation deadline