CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-7273)
CISA added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 switches, to the KEV Catalog due to active exploitation. BOD 26-04 requires FCEB agencies to remediate KEV-listed vulnerabilities on publicly exposed assets that grant total control post-exploitation. CISA encourages all organizations to prioritize patching and check for prior system compromise.
Detection / Hunteropenrouter
Immediate Actions
- Patch Zyxel GS1900 switches against CVE-2026-7273 immediately.
- Check for prior compromise before applying patches.
- Isolate affected switches if compromise is confirmed.
Key Takeaways
- CVE-2026-7273 affects Zyxel GS1900 series switches via stack-based buffer overflow.
- BOD 26-04 mandates FCEB agencies check for compromise before applying patches.
- The vulnerability grants total control of the affected asset post-exploitation.
- Organizations can nominate exploited vulnerabilities via CISA KEV Nomination Form.
Attack Chain
- Initial Access: Stack-based buffer overflow exploited on publicly exposed Zyxel GS1900 switch
- Execution: Overflow enables arbitrary code execution on the network device
- Impact: Attacker gains total control of the compromised switch
Affected Systems
- Zyxel GS1900 series switches
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-7273 | Zyxel GS1900 Series Switches | Critical | Stack-based buffer overflow allows total control of the device. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Network switches lack EDR agents; no host-based telemetry is available. |
| Network Visibility | Medium | Exploitation of network devices may produce traffic anomalies on management interfaces. |
| Detection Difficulty | Hard | Network devices lack host-based telemetry; exploitation may resemble admin sessions. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Unexpected management sessions to Zyxel GS1900 switches from non-admin sources indicate exploitation (T1190). | Network flow logs and switch syslog | Initial Access | Low — admin sessions originate from known management subnets |
Required Log Sources
- Zyxel switch syslog
- Network flow data
- Firewall logs
- SIEM correlation alerts
Key Behavioral Indicators
- Unexpected admin sessions to Zyxel switch management interfaces
- Anomalous traffic patterns from switch management ports
- New or unknown accounts created on Zyxel switches
Control Gaps
- No EDR coverage on network switches
- Switch management interface logging may be disabled
- Network flow data may not capture management plane traffic
False Positive Assessment
Low — buffer overflow exploitation on network switches is anomalous and unlikely in normal operations.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Remove public exposure of switch management interfaces.
- Restrict management access to VPN or trusted internal networks.
- Enable logging on all Zyxel switch management interfaces.
MITRE ATT&CK Mapping
Initial Access
Plain-Language Summary
CISA added a security flaw in Zyxel GS1900 network switches to its list of actively exploited vulnerabilities. The flaw is a buffer overflow that lets attackers take full control of the device. Federal agencies must patch it under government directive. All organizations should patch and check for prior compromise.
- cveCVE-2026-7273Stack-based buffer overflow allows total control of the device.