Act
active
Zyxel GS1900 and Veeam Flaws Actively Exploited, CISA KEV Listed
- Engineer — Act: CVE-2026-7273 is CISA KEV-listed with a public PoC on GitHub; patch Zyxel GS1900 series switch firmware immediately and audit Veeam deployments for associated flaws granting SYSTEM-level access.
- SOC/IR — Act: Active exploitation of an edge network device warrants an assume-breach posture; sweep for Zyxel GS1900 switches in the estate and hunt for anomalous lateral movement or command execution sourced from switch management interfaces since the disclosure date.
- Leader — Plan: CISA KEV confirmation of active exploitation in network switches and backup software (Veeam) is a concrete risk item; confirm with engineering this week that Zyxel GS1900 and Veeam instances in your environment are patched and request a status update before month-end.
- Signals: CVE-2026-7273 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.