CISA Adds Zyxel Vulnerability to KEV – Catalog – 9-21-26

Today, CISA announced that they had added a stack-based buffer overflow vulnerability in the Zyxel GS1900 series switches to their Known Exploitable Vulnerabilities (KEV) catalog. Zyxel reported the vulnerability on June 16th, 2026. The vulnerability was reported to Zyxel by Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu, and Tianyue Luo from Institute of Software, Chinese Academy of Sciences (ISCAS). 

Today, GreyNoise reported (in an article about a WordPress exploit): 

“In addition to the above findings, GreyNoise discovered the MCA [malicious cyber actor] targeted ZyXEL GS1900 Smart Managed Switches globally with a novel exploit of CVE-2026-7273. As of 17 September 2026, this is the first publicly documented case of exploitation in the wild of this vulnerability, which is also not on [obviously dated before today’s CISA announcement] the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog at the time of publication. The MCA successfully exploited and exfiltrated sensitive data from 996 ZyXEL switches across 48 countries.” 

CISA has directed federal agencies using the affected Zyxel devices to apply “mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements” [Links added]. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.” 

A compliance date of September 24th, 2026, has been established. 

Review - Public ICS Disclosures – Week of 6-13-26 – Part 2

For Part 2 we have 11 additional vendor disclosures from Ingecon, Moxa (3), NI, Splunk (2), ThingsBoard, TP-Link, Turck, and Zyxel. Part 3 is coming tomorrow. 

Advisories  

Ingecon Advisory - INCIBE-CERT published an advisory that describes a use of broken or risky cryptographic algorithm vulnerability in the Ingecon EMS Board. 

Moxa Advisory #1 - Moxa published an advisory that describes a missing authentication vulnerability in their Serial Device Servers. 

Moxa Advisory #2 - Moxa published an advisory that describes two vulnerabilities in their Serial Device Servers. The vulnerabilities were reported by Remi ONNO of CS GROUP. 

Moxa Advisory #3 - Moxa published an advisory that describes an improper validation of specified type of input vulnerability in their Serial Device Servers. 

NI Advisory - NI published an advisory that describes seven vulnerabilities in their gRPC Device Server. 

Splunk Advisory #1 - Splunk published an advisory that describes an OS command injection vulnerability in their AI Toolkit. 

Splunk Advisory #2 - Splunk published an advisory that describes an OS command injection vulnerability in their AI Toolkit. 

ThingsBoard Advisory - JP-CERT published an advisory that describes a prototype pollution vulnerability in the ThingsBoard open-source IoT platform. 

TP-Link Advisory - TP-Link published an advisory that describes two OS command injection vulnerabilities in their TL-WR940N wireless router. 

Turck Advisory - CERT-VDE published an advisory that discusses two vulnerabilities (one with a publicly available exploit) in Turck Managed Ethernet Switches. 

Zyxel Advisory - Zyxel published an advisory that describes a stack-based buffer overflow vulnerability in their GS1900 series switches. 

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-6-c60 - subscription required. 

Review - Public ICS Disclosures – Week of May 30th, 2026 – Part 2

For Part 2 we have seven additional vendor disclosures from Siemens, Supermicro, TP-Link (4), and Zyxel. There are also three vendor updates from HP (2) and Westermo. Finally, we have two exploits for vulnerabilities in products from Palo Alto Networks. 

Advisories  

Siemens Advisory - Siemens published an advisory that discusses 77 vulnerabilities in their RUGGEDCOM RST2428P (SINEC OS) product. 

Supermicro Advisory - Supermicro published an advisory that describes an OS command injection vulnerability in multiple Supermicro products. 

TP-Link Advisory #1 - TP-Link published an advisory that describes five vulnerabilities in their Tapo C520WS cameras. 

TP-Link Advisory #2 - TP-Link published an advisory that describes an improper input validation vulnerability in their Tapo C520WS cameras. 

TP-Link Advisory #3 - TP-Link published an advisory that describes a stack-based buffer overflow vulnerability in their Tapo C200 cameras. 

TP-Link Advisory #4 - TP-Link published an advisory that describes a cross-site scripting vulnerability in their TL-SG108PE smart switch. 

Zyxel Advisory - Zyxel published an advisory that describes two classic buffer overflow vulnerabilities in multiple Zyxel wireless network products. 

Updates  

HP Update #1 - HP published an update for their Intel Graphics advisory that was originally published on September 22nd, 2025, and most recently updated on March 16th, 2026. 

HP Update #2 - HP published an update for their NVIDIA GPU Display Driver advisory that was originally published on October 30th, 2025, and most recently updated on December 12th, 2025. 

Westermo Update - Westermo published an update for their Viper 3000 Bootloader advisory that was originally published on March 31st, 2026. 

Exploits  

Palo Alto Networks Exploit #1 - Ashraf Zaryouh published an exploit for a reliance on cookies without validation and integrity checking vulnerability in Palo Alto Networks PAN-OS software. 

Palo Alto Networks Exploit #2 - Tushar Gurav published an exploit for a reliance on cookies without validation and integrity checking vulnerability in Palo Alto Networks PAN-OS software. 

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-may-d94 - subscription required.