CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on 21 September 2026 (catalogVersion 2026.09.21; FCEB due 24 September 2026; forensic triage required under BOD 26-04).

Zyxel’s security advisory (16 June 2026) documents a stack-based buffer overflow (CWE-121) in the CGI program of GS1900 series switch firmware: a LAN-based, unauthenticated attacker can send a crafted HTTP request and potentially execute OS commands. NVD (Zyxel as CVSS source) scores CVSS 3.1 8.8 High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); NVD description cites GS1900-48HPv2 firmware through 2.90(ABTQ.1)C0. Vendor patch table maps each GS1900 SKU from 2.90(.*).1)C0 and earlier to fixed 2.90(.*).2)C0 builds (e.g. GS1900-48HPv2 → 2.90(ABTQ.2)C0; GS1900-8 → 2.90(AAHH.2)C0).

Known ransomware campaign use: Unknown per CISA. Australia relevance: GS1900 is a common SMB/managed-access switch line — patch LAN-management exposure.

UPDATE (5 Nov 2026, Perth; Zyxel; BleepingComputer): the June fix for this CVE is not enough. Zyxel published a separate advisory on 3 November 2026 for CVE-2026-107441, an out-of-bounds write in the same GS1900 CGI program that affects the 2.90(.2)C0 builds that fixed CVE-2026-7273, with fixes in 2.90(.3)C0 builds. (source: Zyxel)

According to BleepingComputer, Binarly found that the exploit used in the Kapibala attacks still worked against all ten releases patched for CVE-2026-7273, so CVE-2026-107441 is the zero-day behind those attacks; see the CVE-2026-107441 card. (source: BleepingComputer)