Zyxel GS1900 and Veeam Flaws Actively Exploited, CISA KEV Listed

Tue, 22 Sep 2026 15:30:54 +0000

Engineer — Act: CVE-2026-7273 is CISA KEV-listed with a public PoC on GitHub; patch Zyxel GS1900 series switch firmware immediately and audit Veeam deployments for associated flaws granting SYSTEM-level access.
SOC/IR — Act: Active exploitation of an edge network device warrants an assume-breach posture; sweep for Zyxel GS1900 switches in the estate and hunt for anomalous lateral movement or command execution sourced from switch management interfaces since the disclosure date.
Leader — Plan: CISA KEV confirmation of active exploitation in network switches and backup software (Veeam) is a concrete risk item; confirm with engineering this week that Zyxel GS1900 and Veeam instances in your environment are patched and request a status update before month-end.
Signals: CVE-2026-7273 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub

Veeam on CuraSec