Chinese Hackers Exploit Zyxel Switch Vulnerability CVE-2026-7273

• •CVE-2026-7273 exploited in 996 Zyxel switches across 48 countries.
• •564 compromised devices used factory default credentials.
• •CISA mandates federal agencies to patch by September 24, 2026.

A Chinese-speaking threat actor has exploited a stack-based buffer overflow vulnerability (CVE-2026-7273) in Zyxel GS1900 switches, compromising 996 devices across 48 countries since August 17, 2026. The vulnerability allows unauthenticated attackers to execute OS commands via crafted HTTP requests. Zyxel released patches for the affected firmware versions in June 2026, but many devices remained unpatched. GreyNoise reported that 564 of the compromised devices were using factory default credentials, increasing their vulnerability. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch the flaw by September 24, 2026. The threat actor is believed to be linked to previous attacks on WordPress and Gitea instances. The exploit code was found to be heavily obfuscated, complicating detection efforts.