Our automated tracking framework flagged that CISA added CVE-2026-7273 (Zyxel GS1900 Series Switches) to the Known Exploited Vulnerabilities (KEV) catalog on September 22, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-7273 by September 24, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-7273 |
| Vendor / product | Zyxel GS1900 Series Switches |
| Vulnerability | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability |
| CVSS base score | 8.8 |
| Added to KEV | September 21, 2026 |
| Days public before listing (NVD → KEV lag) | 97 |
| Federal patch deadline | September 24, 2026 |
| Known ransomware use | No |
How This Compares to Zyxel’s Track Record
This one was public for 97 days before CISA confirmed exploitation — longer than Zyxel’s 12-day median, a vulnerability that sat exploitable in the open.
| Zyxel in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 13 |
| Median lag (public → KEV listing) | 12 days |
| 0-day rate (exploited at or before disclosure) | 0% |
| Entries tied to known ransomware campaigns | 2 |
For perspective, the median across all 1716 tracked KEV entries is 251 days — Zyxel’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Zyxel KEV Additions
The most recent Zyxel vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2024-40891 | DSL CPE Devices | February 11, 2025 | 7 | No |
| CVE-2024-40890 | DSL CPE Devices | February 11, 2025 | 7 | No |
| CVE-2024-11667 | Multiple Firewalls | December 3, 2024 | 6 | ⚠️ Yes |
| CVE-2017-6884 | EMG2926 Routers | September 18, 2023 | 2356 | ⚠️ Yes |
| CVE-2017-18368 | P660HN-T1A Routers | August 7, 2023 | 1558 | No |
What This Means for Defenders
CISA has added CVE-2026-7273, a stack-based buffer overflow vulnerability affecting Zyxel GS1900 Series Switches, to its Known Exploited Vulnerabilities (KEV) catalog. With a CVSS base score of 8.8, it presents a critical risk. Federal agencies must patch by September 24, 2026. This vulnerability was public for 97 days before its KEV listing, confirming active exploitation and making patching an immediate priority for all organizations using these switches.
Patch CVE-2026-7273 before the September 24 deadline. If you can’t, implement compensating controls like isolating affected devices and restricting network access to only essential services and trusted sources. Enhance monitoring for unusual activity originating from or targeting Zyxel GS1900 Series Switches. Prompt patching remains the most effective defense against this actively exploited vulnerability.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
