The addition of CVE-2026-7273 to CISA's Known Exploited Vulnerabilities (KEV) Catalog highlights a critical reality: network switches, often considered passive infrastructure components, can become valuable targets for attackers when their management interfaces contain exploitable vulnerabilities.

The vulnerability affects multiple Zyxel GS1900 Series switches and stems from a stack-based buffer overflow in the firmware's CGI program.

According to Zyxel's security advisory, an unauthenticated attacker with LAN access could exploit the vulnerability by sending a specially crafted HTTP request, potentially executing operating system commands on the affected switch.

The vulnerability carries a CVSS v3.1 score of 8.8 (High). Its inclusion in CISA's KEV Catalog on September 21, 2026, confirms that exploitation has been observed in the wild.

Why is this vulnerability particularly dangerous?

Unlike vulnerabilities affecting ordinary endpoint applications, a security weakness in a network switch can potentially compromise a critical component responsible for connecting multiple systems.

A successful exploitation attempt could provide an attacker with unauthorized access to the switch's operating environment.

Depending on the privileges obtained and the switch's configuration, compromise could potentially allow attackers to manipulate device settings, disrupt network connectivity, or interfere with traffic handling.

In environments where switches connect servers, workstations, storage systems, surveillance devices, and other critical infrastructure, the consequences could extend beyond a single device.

Importantly, this vulnerability does not require authentication. An attacker who gains access to the vulnerable management interface through the local network may be able to exploit it without possessing administrator credentials.

This also raises the risk associated with compromised endpoints and unauthorized devices operating inside enterprise networks.

Why does internal network security matter?

The attack vector identified by Zyxel is LAN-based. This means the vulnerability should not automatically be described as remotely exploitable from anywhere on the internet.

However, organizations should not interpret this limitation as an assurance of safety.

An attacker who has already compromised an endpoint, obtained access through a poorly secured VPN, or gained access to an inadequately segmented network could potentially reach the vulnerable management interface.

This illustrates the importance of securing internal network infrastructure rather than relying exclusively on perimeter defenses.

What should organizations do immediately?

Organizations using Zyxel GS1900 Series switches should identify affected devices and verify their installed firmware versions against Zyxel's official advisory.

Zyxel released security patches on June 16, 2026, for ten affected switch models. Administrators should install the appropriate model-specific firmware updates without unnecessary delay.

Security teams should also:

  1. Restrict access to switch management interfaces to dedicated management networks and authorized administrator systems.

  2. Block unnecessary HTTP and HTTPS management access from user VLANs and untrusted network segments.

  3. Review switch configuration changes, management access logs, and other available indicators of unauthorized activity.

  4. Investigate suspicious requests targeting switch management interfaces, particularly unexpected access originating from user devices.

  5. Implement network segmentation to limit an attacker's ability to move from a compromised endpoint to critical infrastructure.

  6. Verify the integrity of affected devices before returning them to normal operation if compromise is suspected.

Applying a firmware patch closes the known vulnerability, but it does not automatically remove malicious changes or attacker access that may already have been established.

The bigger cybersecurity lesson

Organizations frequently prioritize operating systems, servers, firewalls, and endpoint applications when implementing vulnerability management programs.

However, managed switches, wireless access points, routers, and other networking devices also contain operating systems, embedded web servers, management APIs, and services that can introduce exploitable vulnerabilities.

These devices may remain in production for years, sometimes with limited monitoring and infrequent firmware updates.

CVE-2026-7273 demonstrates why network infrastructure must be included in continuous asset discovery, vulnerability assessment, patch management, and incident-response processes.

The transition from a publicly disclosed vulnerability in June to inclusion in CISA's exploited-vulnerability catalog in September reinforces another important point: organizations cannot assume that a previously disclosed vulnerability remains a theoretical risk simply because no exploitation was known when it was first announced.

The key takeaway: A secure network requires more than protecting traffic passing through its infrastructure. The infrastructure itself must also be protected.

Every managed switch represents a potential attack surface, and overlooking its security can expose the very systems it was deployed to connect.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-7273 Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV

Source: CISA Adds One Known Exploited Vulnerability to Catalog via CISA Advisories — published 21 Sep 2026.