Zyxel and Veeam Vulnerabilities Under Active Exploitation

• •CISA added CVE-2026-7273 to its KEV catalog due to active exploitation.
• •Zyxel's GS1900 series switches are vulnerable to a stack-based buffer overflow.
• •Active exploitation of Veeam Agent for Windows allows SYSTEM-level control.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Zyxel GS1900 series switches (CVE-2026-7273) to its Known Exploited Vulnerabilities catalog due to active exploitation. This stack-based buffer overflow flaw allows unauthenticated attackers to execute OS commands via crafted HTTP requests. Zyxel released patches for affected firmware versions on June 16, 2026, and federal agencies must apply these fixes by September 24, 2026. Concurrently, Arctic Wolf reported active exploitation of a local privilege escalation vulnerability in Veeam Agent for Windows (CVE-2026-32996), enabling attackers with local access to gain SYSTEM-level control. The Veeam vulnerability stems from improper handling of elevated client sessions, and a public proof-of-concept (PoC) was released on September 16, 2026. Both vulnerabilities pose significant risks to organizations using these products.