Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access
Summary: CISA added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 series switch firmware with a CVSS score of 8.8, to its KEV catalog on Monday, citing active exploitation. GreyNoise reported a suspected Chinese-speaking actor exploiting the flaw since August 17, 2026, exfiltrating configuration data, hashed root credentials, and networking information from 996 switches across 48 countries, while Arctic Wolf separately warned of active exploitation of CVE-2026-32996, a local privilege escalation in Veeam Agent for Microsoft Windows that yields SYSTEM access.
What you should know: Nearly a thousand switches in 48 countries have already been hit, and the stolen data includes hashed root credentials and configurations - the material an attacker needs to move from the network edge into everything behind it.