Zyxel GS1900 flaw added to CISA’s exploited-vulnerability catalog, with Thursday federal deadline reported

A LAN attacker could execute OS commands

BleepingComputer reported that CISA listed CVE-2026-7273, a stack-based buffer-overflow vulnerability in Zyxel GS1900 series switches, in its Known Exploited Vulnerabilities (KEV) Catalog. The report says the flaw can allow an unprivileged actor on a local area network to execute operating-system commands through crafted HTTP requests.

It also says CISA ordered Federal Civilian Executive Branch (FCEB) agencies to secure their switches by Thursday under Binding Operational Directive 26-04. CISA reportedly described ongoing attacks, while Zyxel had not updated its own advisory to confirm active exploitation.

Before the reported catalog addition, Zyxel had released firmware updates on June 16, while its advisory had not been updated to confirm active exploitation.

The report says CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog and directed FCEB agencies to secure affected switches by Thursday.

The agencies covered by Thursday’s deadline

A KEV listing changes the reported status from an available vendor fix to a required remediation action for FCEB agencies. The directive’s scope is limited to those agencies, although CISA reportedly encouraged other organizations to prioritize KEV vulnerabilities as part of risk-based management.