CISA orders feds to patch Zyxel flaw exploited for data theft

​Attackers are now actively exploiting a high-severity vulnerability in Zyxel GS1900 series switches, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

The flaw (tracked as CVE-2026-7273) stems from a stack-based buffer overflow in the CGI program that lets threat actors without privileges on the local area network (LAN) execute OS commands via maliciously crafted HTTP requests.

Zyxel released security updates to address this issue on June 16 and advised customers to upgrade their firmware "for optimal protection."

While Zyxel has yet to update its advisory to confirm active exploitation of this flaw, CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) Catalog on Monday and ordered Federal Civilian Executive Branch (FCEB) agencies to secure their switches against ongoing attacks by Thursday as mandated by Binding Operational Directive (BOD) 26-04.