CVE-2026-7273

HIGH8.8

CISA KEV

Published 2026-06-16 · Updated 2026-09-22 · Source security@zyxel.com.tw

Summary

CVE-2026-7273 is a high-severity (CVSS 8.8) vulnerability in Zyxel GS1900 Series Switches. CISA added it to the Known Exploited Vulnerabilities catalog on September 21, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 24, 2026. CISA does not currently list it as used in ransomware campaigns. Zyxel has 13 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.

All 13 known-exploited Zyxel vulnerabilities →

Description

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-121

CISA Known-Exploited Vulnerability

Product: Zyxel — GS1900 Series Switches

Name: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

Date added: 2026-09-21 · Due: 2026-09-24

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

View on NVD

More exploited Zyxel vulnerabilities

Most recently added to CISA KEV

CVE-2024-40891
DSL CPE Devices — Zyxel DSL CPE OS Command Injection Vulnerability
added 2025-02-11
CVE-2024-40890
DSL CPE Devices — Zyxel DSL CPE OS Command Injection Vulnerability
added 2025-02-11
CVE-2024-11667
RANSOMWARE
Multiple Firewalls — Zyxel Multiple Firewalls Path Traversal Vulnerability
added 2024-12-03
CVE-2017-6884
RANSOMWARE
EMG2926 Routers — Zyxel EMG2926 Routers Command Injection Vulnerability
added 2023-09-18
CVE-2017-18368
P660HN-T1A Routers — Zyxel P660HN-T1A Routers Command Injection Vulnerability
added 2023-08-07
CVE-2023-27992
Multiple Network-Attached Storage (NAS) Devices — Zyxel Multiple NAS Devices Command Injection Vulnerability
added 2023-06-23

View all →

Related CVEs

Same severity, most recent

CVE-2026-96660
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.
2026-10-17 · score 7.2
CVE-2026-92798
The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.
2026-10-17 · score 8.1
CVE-2026-108123
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.
2026-10-17 · score 7.5
CVE-2026-103899
The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce → Orders → Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation.
2026-10-17 · score 7.2
CVE-2026-109208
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout.
2026-10-17 · score 7.2