CISA Flags Active Exploits in Zyxel Switches and Veeam Flaws

Introduction

A fresh wave of exploitation activity targeting critical network infrastructure has prompted urgent action from federal cybersecurity authorities. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently expanded its Known Exploited Vulnerabilities (KEV) catalog to include a high-severity flaw affecting Zyxel GS1900 series switches, marking another instance where threat actors are weaponizing unpatched network devices at scale. This development coincides with heightened exploitation of vulnerabilities in Veeam backup and recovery solutions, creating compounding risk for organizations that rely on these technologies for core operations.

The Zyxel vulnerability, identified as CVE-2026-7273, represents a classic yet dangerous stack-based buffer overflow condition. With a CVSS rating of 8.8, it enables unauthenticated attackers to execute arbitrary operating system commands with elevated privileges—effectively granting full control over the affected switch. CISA’s inclusion of this flaw in the KEV catalog is not precautionary; it reflects verified evidence of active exploitation in the wild. For security teams, this serves as a stark reminder that network edge devices remain a prime target for initial access and lateral movement.

Anatomy of the Zyxel GS1900 Exploit Chain

The affected Zyxel GS1900 series comprises managed Gigabit Ethernet switches widely deployed in small-to-medium business environments, branch offices, and edge networking scenarios. These devices often sit at the network perimeter or in distribution layers, making them attractive pivot points for adversaries seeking to bypass perimeter defenses. The buffer overflow vulnerability resides in the web-based management interface, where improper input validation allows crafted HTTP requests to overwrite stack memory and hijack execution flow.

• Attack Vector: Network-accessible, unauthenticated via HTTP/HTTPS management portal
• Impact: Full SYSTEM-level command execution on the underlying OS
• Exploit Maturity: Functional proof-of-concept code circulating; active campaigns observed
• Patch Status: Vendor-released firmware updates available for all affected models

What makes this particularly concerning is the operational context: many GS1900 switches run for years without firmware updates, either due to limited maintenance windows, lack of asset visibility, or the misconception that switches are “set-and-forget” devices. Threat actors know this and routinely scan for exposed management interfaces on non-standard ports.

Veeam Backup Infrastructure Under Siege

While the Zyxel flaw dominates headlines, parallel exploitation of Veeam Backup & Replication vulnerabilities continues to escalate. Multiple CVEs affecting Veeam components—including CVE-2023-27532 and CVE-2024-29849—have been leveraged in ransomware campaigns to exfiltrate backup configurations, delete recovery points, and encrypt production workloads. The common thread? Exposed management consoles and unpatched servers running outdated builds.

Adversaries targeting Veeam often combine credential theft (via exposed Veeam console credentials or reused admin passwords) with vulnerability exploitation to achieve domain compromise. Since backup servers typically hold high-privilege service accounts for application-aware processing, a single compromised Veeam host can become a domain controller in disguise.

Operational Risk Amplification in Hybrid Environments

The convergence of these two threat vectors—network switch compromise and backup infrastructure exploitation—creates a nightmare scenario for defenders. An attacker with control over a core switch can manipulate VLANs, span ports for traffic interception, or redirect backup traffic to malicious collectors. When paired with a compromised Veeam server, the adversary gains both network persistence and the ability to sabotage recovery capabilities.

This dual-threat dynamic is especially acute in hybrid environments where on-premises switches connect to cloud-hosted backup repositories. A compromised edge switch can serve as a man-in-the-middle position to intercept API calls between on-prem Veeam proxies and cloud object storage, potentially exfiltrating encryption keys or backup metadata.

Conclusion

The addition of CVE-2026-7273 to the CISA KEV catalog is more than a compliance checkbox—it’s an operational directive. Every unpatched Zyxel GS1900 switch with an exposed management interface represents a potential beachhead. Likewise, every unpatched Veeam server is a loaded weapon pointed at your recovery strategy. Patching is non-negotiable, but so is architecture: segment management planes, monitor for anomalous switch behavior (unexpected config changes, new admin accounts), and validate that backup immutability controls cannot be overridden from a compromised host. Grivyonx Cloud’s AI-driven exposure management platform continuously correlates asset vulnerability state with threat intelligence feeds like CISA KEV, enabling security teams to prioritize remediation based on active exploitation risk—not just severity scores.