CISA orders federal agencies to patch actively exploited Zyxel switch flaw

The U.S. Cybersecurity and Infrastructure Security Agency added a command-execution flaw in Zyxel GS1900 switches to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to secure affected devices by Thursday. CVE-2026-7273 is a stack-based buffer overflow that lets an unauthenticated attacker on the local network send a crafted HTTP request and execute operating-system commands. Zyxel issued corrected firmware on June 16. GreyNoise reported that a suspected Chinese-speaking actor exploited the flaw to extract sensitive data from 996 switches across 48 countries, although CISA has not released details of the attacks.