[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6P7FH1IHpYUwDXBjt_ka9pkNk2cKHJ4qzFSov30D7fo":3},{"article":4,"iocs":49,"watch_terms":57,"solutions":58,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"5b023265-84c4-493c-bc10-99c5da54bedf","Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access","zyxel-and-veeam-flaws-under-active-exploitation-with-command-and-system-access-b6c97d","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-7273 (CVSS score: 8.8), is a stack-based buffer overflow vulnerability that could result in arbitrary operating","CISA has added a vulnerability in Zyxel GS1900 series switches (CVE-2026-7273) to its Known Exploited Vulnerabilities catalog, noting active exploitation. This stack-based buffer overflow flaw allows unauthenticated LAN-based attackers to execute OS commands. Additionally, Arctic Wolf reported active exploitation of a local privilege escalation vulnerability in Veeam Agent for Windows (CVE-2026-32996), allowing attackers with local access to gain SYSTEM-level control.","CISA adds Zyxel and Veeam flaws to KEV catalog due to active exploitation.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fzyxel-and-veeam-flaws-under-active.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjj9eouOxeSvnYBzl5A8tWvEQ4w_CCx94YcFmpBAXXqHWNqvFBWj4vOgeZdHYAf0MU-chY63biCpHDnzRC0pwR7s3pTdQAWwPAVI-olRZuBwG0ilgAxnIY_1KofE3cpuA8lKOE01U26EFHYE_nLrXYXOWl47G1KaoFTZ5UOO81Cw0Kb20pFSfAc1b9i9E_K\u002Fs1600\u002Fveeam.jpg","2026-09-22T05:31:59+00:00","2026-09-22T08:00:29.46545+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"GS1900 series switches","product",{"name":21,"type":22},"Zyxel","vendor",{"name":24,"type":19},"Veeam Agent for Microsoft Windows",{"name":26,"type":22},"Veeam",{"name":28,"type":19},"Veeam Endpoint Backup service",{"name":30,"type":22},"Arctic Wolf","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54],{"type":51,"value":52,"context":53},"cve","CVE-2026-7273","Zyxel GS1900 series switch stack-based buffer overflow vulnerability",{"type":51,"value":55,"context":56},"CVE-2026-32996","Veeam Agent for Windows local privilege escalation vulnerability",[21,26,30],{"controls":59,"vendors":146},[60,89,117],{"slug":61,"name":62,"problem":63,"products":64},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":90,"name":91,"problem":92,"products":93},"patch-management","Automated patch management","Known holes get closed in days, not months.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":90,"product_name":114,"url":115,"description":116},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":118,"name":119,"problem":120,"products":121},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[147,152],{"slug":148,"name":30,"logo_path":149,"roles":150},"arctic-wolf","\u002Fvendor-logos\u002Farctic-wolf.png",[151],"reported_by",{"slug":153,"name":26,"logo_path":154,"roles":155},"veeam","\u002Fvendor-logos\u002Fveeam.png",[156],"affected",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":172},"unpatched-zyxel-and-veeam-flaws-actively-exploited-for-command-and-system-access","Unpatched Zyxel and Veeam Flaws Actively Exploited for Command and SYSTEM Access","Attackers are actively exploiting a stack-based buffer overflow in Zyxel GS1900 switches that allows unauthenticated LAN-based attackers to execute OS commands, and a local privilege escalation flaw in Veeam Agent for Windows that grants SYSTEM-level control. Both vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog, signaling confirmed, real-world abuse. The Zyxel flaw is particularly dangerous because it requires no authentication, meaning any device on the local network segment can serve as an attack origin. Together, these flaws highlight the compounding risk of unpatched network infrastructure and endpoint backup agents — two asset classes that are often deprioritized in patch cycles. Delays in applying available patches directly translate into open windows for attackers to gain deep, persistent control.",[162,163,164,165,166,167,168,169,170,171],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 12: Network Infrastructure Management","NIST SP 800-40: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-6: Least Privilege","NIST SC-7: Boundary Protection","CISA KEV Catalog Binding Operational Directive 22-01","ITIL Change Management: Emergency Change Procedures","NIST CM-8: Information System Component Inventory",{}]