CISA Flags Active Attacks on Zyxel Switches and Veeam Windows Agent

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added an already-patched flaw in Zyxel's GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active attacks.

The bug, tracked as CVE-2026-7273 (CVSS score: 8.8), is a stack-based buffer overflow that can lead to arbitrary operating system command execution. According to Zyxel, the flaw sits in the CGI program of the switch firmware: an unauthenticated, LAN-based attacker can exploit it with a crafted HTTP request and potentially run OS commands. The company published its advisory back in June 2026.

Fixes have been released across the lineup, from the GS1900-8 to the GS1900-48HPv2. The vulnerability was found and reported by Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu and Tianyue Luo of ISCAS.

CISA did not disclose who is behind the attacks, when they began, how many organizations were targeted, or what the attackers did once inside. Zyxel itself had not, at the time of writing, updated its advisory to confirm active exploitation. Federal civilian agencies are required to apply the updates by September 24, 2026.

Attacks on Veeam Agent for Windows

At the same time, Arctic Wolf warned of active exploitation of CVE-2026-32996 (CVSS score: 7.3), a local privilege escalation flaw in Veeam Agent for Microsoft Windows that lets an attacker with local access gain SYSTEM-level control of an affected endpoint.

The problem lies in how the Veeam Endpoint Backup service handles elevated client sessions over a local gRPC named pipe. The service caches an elevated administrator principal against a client-controlled session UID that is not bound to the requesting user or connection.

Because those UIDs are written to a log file readable by standard users, an attacker can obtain a valid UID and use it to run commands as SYSTEM. A public GitHub proof-of-concept demonstrates the technique by running whoami and writing the output to a file.

Source: The Hacker News