New Zyxel and Veeam vulnerabilities are being actively exploited, according to new warnings from the US cybersecurity agency CISA and researchers at Arctic Wolf . CISA has added a previously patched vulnerability affecting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) list , while a serious threat to users of Veeam Agent for Microsoft Windows is also emerging . These two vulnerabilities, although different in nature, share a common denominator: they provide attackers with a dangerously high level of access to infected systems.
Zyxel vulnerability
The first vulnerability, with the identifier CVE-2026-7273 and a CVSS score of 8.8, concerns a stack-based buffer overflow in the firmware of Zyxel GS1900 series switches. Specifically, the flaw is located in the CGI program and allows an unauthenticated attacker located on the local area network (LAN-based) to execute arbitrary operating system commands via a specially crafted HTTP request. Zyxel disclosed the vulnerability in an advisory it issued in June 2026, attributing the discovery to researchers Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu , and Tianyue Luo from ISCAS.
CISA’s inclusion of CVE-2026-7273 in the KEV list signals that there is strong evidence of active exploitation. However, the agency has not disclosed who is behind the attacks, when they started, how many organizations have been targeted, or what actions the attackers took after the breach. This lack of information makes the need to apply available updates immediately even more urgent.
See also: CVE-2026-8508: Zyxel WAX650S exposes captive portal to authentication bypass
Zyxel GS1900: Technical details of the vulnerability and the risk to networks
Stack -based buffer overflow is one of the most classic and dangerous classes of vulnerabilities. In the case of CVE-2026-7273, an attacker can send a specially crafted HTTP request to the switch's CGI program , causing a stack buffer overflow and, consequently, execution of arbitrary code with operating system privileges. What is particularly worrying is that the attack does not require any form of authentication — all the attacker needs is access to the local area network (LAN). This means that an insider threat actor or someone who has already gained access to the corporate network can exploit the vulnerability without any special technical expertise.
Zyxel GS1900 series switches are widely used in corporate and professional environments, which makes the vulnerability particularly serious. Zyxel has released firmware updates that address the issue, and network administrators are urged to apply the updates immediately. According to the CISA directive, Federal Civilian Executive Branch (FCEB) agencies are required to apply the fixes by September 24, 2026.However, this recommendation applies to virtually any organization using the equipment in question.
The issue has been resolved in the following releases –
GS1900-8 2.90(AAHH.1)C0 and earlier – Fixed in version 2.90(AAHH.2)C0
GS1900-8HP 2.90(AAHI.1)C0 and earlier – Fixed in version 2.90(AAHI.2)C0
GS1900-10HP 2.90(AAZI.1)C0 and earlier – Fixed in version 2.90(AAZI.2)C0
GS1900-16 2.90(AAHJ.1)C0 and earlier – Fixed in version 2.90(AAHJ.2)C0
GS1900-24 2.90(AAHL.1)C0 and earlier – Fixed in version 2.90(AAHL.2)C0
GS1900-24E 2.90(AAHK.1)C0 and earlier – Fixed in version 2.90(AAHK.2)C0
GS1900-24EP 2.90(ABTO.1)C0 and earlier – Fixed in version 2.90(ABTO.2)C0
GS1900-24HPv2 2.90(ABTP.1)C0 and earlier – Fixed in version 2.90(ABTP.2)C0
GS1900-48 2.90(AAHN.1)C0 and earlier – Fixed in version 2.90(AAHN.2)C0
GS1900-48HPv2 2.90(ABTQ.1)C0 and earlier – Fixed in version 2.90(ABTQ.2)C0
Veeam Agent: Vulnerability that gives SYSTEM access to Windows
In addition to the threat facing Zyxel, cybersecurity firm Arctic Wolf has issued an advisory for active exploitation of CVE-2026-32996, a local privilege escalation in Veeam Agent for Microsoft Windows with a CVSS score of 7.3. The vulnerability allows an attacker with local access to gain SYSTEM over affected endpoints — the highest possible level of privilege in Windows.
The technical background of the vulnerability is particularly interesting. The problem lies in the way the Veeam Endpoint Backup handles elevated client sessions over the local gRPC named pipe. Specifically, the service cachesanelevated administrator principal against a session UID that is controlled by the client and is not associated with the requesting user or the connection. This architectural weakness creates a critical security hole that can be exploited by any local user.
See also: Microsoft zero-day: Two Windows vulnerabilities actively exploited
The critical exploit is that elevated session UIDs are recorded in the Veeam service log, which is readable by standard users without administrative privileges. This allows an attacker to obtain a valid UID and use it to execute commands as SYSTEM. The public PoC exploit released on GitHub demonstrates this technique by executing the whoami and saving the result to a file — a simple but effective demonstration of the severity of the issue.
Zyxel and Veeam: Practical protection steps for organizations
The simultaneous active exploitation of vulnerabilities in Zyxel and Veeam highlights a worrying trend: attackers are increasingly targeting network infrastructure and backup tools, which are often neglected in terms of security updates. Backup, such as Veeam, are particularly attractive targets for ransomware, as their compromise can prevent data recovery after an attack. At the same time, network switches like those from Zyxel are critical infrastructure points that, if compromised, can give attackers full visibility and control over network traffic.
To address these threats, organizations should take the following immediate steps. First, apply available firmware updates for Zyxel GS1900 switches without delay. Second, update Veeam Agent for Microsoft Windows to the latest available version that addresses CVE-2026-32996. Third, implement the principleofon all systems, restricting access to critical logs. Fourth, actively monitor logs for suspicious activity related to Veeam and network switches.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Additionally, network segmentation is recommendedtorestrict access to Zyxel GS1900 switches to authorized management systems only. Using firewall rules to restrict access to the switch management interface can significantly reduce the attack surface, even if the firmware update has not yet been applied. For Veeam, monitoring the service log for unauthorized reading can be an early warning sign of an attack, while disabling the service on systems that do not need it is an additional security measure.
See also: Vulnerability in Veeam Backup & Replication allows RCE attacks
Taken together, these two incidents highlight the importance of a comprehensive vulnerability management programthatcovers not only traditional endpoints but also network infrastructure and backup tools. CISA and Arctic Wolf urge all organizations to take immediate action, as active exploitation means attackers are already exploiting these vulnerabilities in real-world environments.
