CISA orders feds to patch Zyxel flaw exploited for data theft

​Attackers are now actively exploiting a high-severity vulnerability in Zyxel GS1900 series switches, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

The flaw (tracked as CVE-2026-7273) stems from a stack-based buffer overflow in the CGI program that lets threat actors without privileges on the local area network (LAN) execute OS commands via maliciously crafted HTTP requests.

Zyxel released security updates to address this issue on June 16 and advised customers to upgrade their firmware "for optimal protection."

While Zyxel has yet to update its advisory to confirm active exploitation of this flaw, CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) Catalog on Monday and ordered Federal Civilian Executive Branch (FCEB) agencies to secure their switches against ongoing attacks by Thursday as mandated by Binding Operational Directive (BOD) 26-04.

"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," the cybersecurity agency said.

"While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities."

Although CISA has not released details on attacks abusing CVE-2026-7273, threat intelligence company GreyNoise said in a Monday report that it spotted the first signs of exploitation last Thursday.