Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)
A Chinese-speaking threat actor has exploited a vulnerability (CVE-2026-7273) in unpatched ZyXEL GS1900 Smart Managed Switches and has exfiltrated sensitive data from 996 devices across 48 countries, GreyNoise reported on Monday.
The affected switches are predominantly located in Italy, the US, Taiwan, South Korea, and a number of EU countries.
CVE-2026-7273 exploitation is part of an unfolding operation
The Zyxel GS1900 Series is a line of Gigabit Ethernet switches aimed at small and mid-sized business networks. They are typically deployed at small offices, schools, hotels, and retail shops.
CVE-2026-7273 is a stack-based buffer overflow vulnerability affecting Zyxel GS1900 switches running firmware versions 2.90(XXXX.1)C0 and earlier. It allows a LAN-based, unauthenticated attacker to execute OS commands on the device via a specially crafted HTTP request.
The privately reported vulnerability was fixed in June 2026, when Zyxel released new firmware versions with the patch.
The attacks exploiting CVE-2026-7273 happened on or about 17 August, GreyNoise said, and the threat actor grabbed compromised devices’ configuration, networking information, and hashed root level credentials. (According to GreyNoise, 564 of these victims had factory default credentials.)
“The exploit code was contained within a Python script which was heavily obfuscated by the commercial obfuscation tool PyArmor,” the researchers shared.
After deobfuscating it, they discovered it explicitly targets firmware versions 2.10 through 2.90 of the GS1900-24, but “it does provide command line options (e.g. libc base address, global offsets), for targeting other firmware in scope for the vulnerability.”
GreyNoise tied this exploitation activity to a threat actor that is related or the same one that, earlier this year, targeted WordPress setups through CVE-2026-63030 and CVE-2026-60137 (the WP2Shell” exploit chain), and compromised Internet-facing Gitea instances via CVE-2026-60004.
After breaching WordPress installations of 49 organizations across 29 countries, in at least one instance the threat actor deployed a custom web shell, stole WP administrator accounts, credentials, exfiltrated data from SQL databases, and added a new admin account.
After successfully targeting Gitea instances, the threat actor exfiltrated source code, credentials, established persistent access, and leveraged it for lateral movement.
CISA added CVE-2026-7273 – the Zyxel flaw – to its Known Exploited Vulnerabilities catalog, and ordered US civilian federal agencies to address it by September 24, 2026 and check for indicators of compromise.
GreyNoise has shared a list of them, though one IP address involved in the exploitation remains redacted. “We are withholding the exact IP address due to victim sensitivities and operational risk. Once these factors have been mitigated, GreyNoise will publish an update,” the company said.
Also under attack: Veeam Agent for Windows
In other “active exploitation” news, Arctic Wolf says that attackers are exploiting CVE-2026-32996, a local privilege escalation vulnerability in Veeam (backup) Agent for Microsoft Windows, but has not shared details about the attacks.
“Arctic Wolf recommends prioritising remediation on shared workstations, servers, administrator workstations, and systems where local user access is available, or where compromise of a low-privileged account could lead to endpoint takeover,” they advised.
“Upgrade Veeam Backup & Replication to 13.0.2.29 or later. This will also update the Veeam Agent for Windows to build 13.0.3.1220, which contains the fix.”
We’ve reached out to Arctic Wolf for more information, and we’ll update this article when we hear back from them.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
