CISA orders feds to patch Zyxel flaw exploited for data theft

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-7273, a high-severity stack-based buffer overflow vulnerability in Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. The flaw allows unauthenticated threat actors on the local network to execute arbitrary operating system commands via malicious HTTP requests. CISA mandated federal agencies to patch affected systems by Thursday under Binding Operational Directive 26-04. GreyNoise reported that a suspected Chinese-speaking malicious cyber actor has exploited the vulnerability to compromise nearly 1,000 switches globally, exfiltrating sensitive data from 996 devices across 48 countries.

AI-extracted · verify before operational use