Zyxel GS1900 switch flaw CVE-2026-7273 added to CISA KEV
CISA added one vulnerability to its Known Exploited Vulnerabilities catalog on September 21: CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 Series switches, with a CVSS score of 8.8. This is the single most consequential item of the day because it comes with a federal deadline and real numbers behind the exploitation.
Help Net Security reports an attacker has compromised nearly 1,000 Zyxel switches since August, and SecurityWeek attributes the activity to Chinese hackers. BleepingComputer notes CISA has ordered federal agencies to patch the flaw by Thursday because it is being used for data theft. This is not a patch-eventually item. Devices are being taken over now.
If you run Zyxel GS1900 switches, treat this as an emergency change. Confirm firmware versions, apply the vendor fix, and check for signs of unauthorized configuration changes or data exfiltration from switch management interfaces.
Exploited and ransomware-linked CVEs to watch
Beyond the new KEV add, several critical vulnerabilities are drawing heavy exploitation interest, and many are both KEV-listed and ransomware-linked. That combination is the clearest signal to move fast.
At the top: CVE-2026-15409, a SonicWall SMA1000 server-side request forgery flaw at CVSS 10.0, KEV-listed and ransomware-linked with an EPSS score around 0.85. CVE-2026-41940 in WebPros cPanel and WHM sits at CVSS 9.8 with an EPSS near 0.99, also KEV and ransomware-linked. Oracle PeopleSoft PeopleTools CVE-2026-35273 (CVSS 9.8) and Palo Alto Networks PAN-OS authentication bypass CVE-2026-0257 (CVSS 9.1) round out the ransomware-linked set.
- CVE-2026-15409 SonicWall SMA1000 SSRF, CVSS 10.0, KEV, ransomware-linked
- CVE-2026-41940 WebPros cPanel & WHM missing authentication, CVSS 9.8, KEV, ransomware-linked
- CVE-2026-35273 Oracle PeopleSoft PeopleTools, CVSS 9.8, KEV, ransomware-linked
- CVE-2026-0257 Palo Alto Networks PAN-OS authentication bypass, CVSS 9.1, KEV, ransomware-linked
- CVE-2024-1708 ConnectWise ScreenConnect path traversal, CVSS 8.4, KEV, ransomware-linked
- CVE-2026-76460 Cisco Identity Services Engine, CVSS 10.0, KEV
What the press adds today
D-Link warned of a maximum severity zero-day in its DIR-822A routers, CVE-2026-86296, exploitable remotely without authentication. If you have any of these edge devices in scope, treat them like the Zyxel switches and prioritize accordingly.
On the Microsoft side, BleepingComputer reports a new Windows Defender zero-day that blocks Microsoft antivirus updates, and Cyber Security News details a Windows COM flaw, CVE-2026-66804, that lets attackers gain SYSTEM privileges with a malicious DLL. Cyber Security News also covered attackers stealing NTDS.dit to dump Active Directory password hashes and forge golden tickets, a reminder to watch domain controller access closely.
Do this first
Work the KEV list top down. The federal Thursday deadline for the Zyxel flaw is a useful benchmark for everyone, not just agencies.
- Patch Zyxel GS1900 switches for CVE-2026-7273 now and hunt for signs of compromise on management interfaces
- Prioritize the ransomware-linked KEV entries you are exposed to: SonicWall SMA1000, cPanel and WHM, Oracle PeopleSoft, PAN-OS, and ScreenConnect
- Confirm Windows Defender is updating despite the reported zero-day, and review privileged access paths on domain controllers
- Use the Senserva non-Microsoft exploited-CVE tracker to follow KEV additions daily, and the free Microsoft Patch Tracker to rank your open Microsoft patches by KEV, EPSS, and ransomware linkage
Sources
- Cyber Security News: CISA Warns of Zyxel GS1900 Switches Flaw Actively Exploited in Attacks (2026-09-22)
- Help Net Security: Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273) (2026-09-22)
- BleepingComputer: CISA orders feds to patch Zyxel flaw exploited for data theft (2026-09-22)
- SecurityWeek: Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers (2026-09-22)
- CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-09-21)
- BleepingComputer: D-Link warns of max severity zero-day bug in DIR-822A routers (2026-09-22)
- Cyber Security News: D-Link Router Hit by CVSS 10.0 Flaw Exploitable Remotely Without Authentication (2026-09-22)
- BleepingComputer: New Windows Defender zero-day blocks Microsoft antivirus updates (2026-09-22)
- Cyber Security News: Windows COM Flaw Lets Attackers Gain SYSTEM Privileges With a Malicious DLL (2026-09-22)
- Cyber Security News: Hackers Steal NTDS.dit to Dump Active Directory Password Hashes and Forge Golden Tickets (2026-09-22)
Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-09-22.
Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.