CISA orders federal agencies to patch exploited Zyxel switch flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal civilian executive branch agencies to patch a high-severity vulnerability in Zyxel GS1900 series switches. The flaw, identified as CVE-2026-7273, involves a stack-based buffer overflow in the device's CGI program. This allows unauthenticated attackers on a local area network to execute operating system commands via maliciously crafted HTTP requests.

CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that the flaw is being actively exploited. Agencies are mandated to secure their switches against these attacks by Thursday. While the directive specifically applies to federal agencies, CISA encourages all organizations to prioritize remediation.

Exploiting this vulnerability allows an attacker to gain control over the switch's control plane. Potential impacts include the ability to modify VLAN definitions, change port configurations to mirror traffic, read management credentials, and pivot to different network segments. Such access can bypass network separation between user, server, and management traffic.