Patch Forecast
Red warning
Act within 24 hours. CISA deadline for US federal agencies: 24 Sep 2026.

CVE-2026-7273 Exploited in the wild

Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

Risk score
83/100
CVSS
8.8 v3.1
Published
16 Jun 2026
Added to CISA's exploited list
21 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Affected
Zyxel gs1900 Series Switches
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
Exploited in the wild

Story map

Story map: Zyxel gs1900 Series SwitchesTHE FLAWSTHE FIXCVE-2026-7273Zyxel GS1900 Series SwitchesStack-Based Buffer OverflowVulnerabilityCVSS 8.8 · exploitedFixApply the vendor's securityupdate; see the linked advisory.Who is exposedZyxel gs1900 Series SwitchesRED · ACT TODAYZyxel gs1900Series SwitchesA stack-based buffer overflowvulnerability in the CGI programof Zyxel GS1900-48HPv2firmware versions through2.90(ABTQ.1)C0 could allow aLAN-based, unauthenticatedattacker to exploit the flaw…Where it standsExploited in the wildOn CISA's exploited list since 21 SepUS federal deadline 24 SepHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.21 Sep · CISAAdded to the Known Exploited Vulnerabilities list24 Sep · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessStack buffer overflow (CWE-121)232 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Zyxel gs1900 Series Switches: Red, act today. A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

The flaws

  • CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability (CVSS 8.8 · exploited)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Zyxel gs1900 Series Switches

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 21 Sep
  • US federal deadline 24 Sep

How it unfolded

  1. 21 Sep, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 24 Sep, Deadline (official): US federal agencies must have patched

Connects to

Why it is Red

  • CVSS 8.8 high
  • Exploited in the wild (CISA KEV)
  • Public exploit or proof of concept referenced

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

Original description

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Last activity 21 Sep 2026. Patch Forecast updates every hour.