Unpatched Zyxel and Veeam Flaws Actively Exploited for Command and SYSTEM Access
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers are actively exploiting a stack-based buffer overflow in Zyxel GS1900 switches that allows unauthenticated LAN-based attackers to execute OS commands, and a local privilege escalation flaw in Veeam Agent for Windows that grants SYSTEM-level control. Both vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog, signaling confirmed, real-world abuse. The Zyxel flaw is particularly dangerous because it requires no authentication, meaning any device on the local network segment can serve as an attack origin. Together, these flaws highlight the compounding risk of unpatched network infrastructure and endpoint backup agents — two asset classes that are often deprioritized in patch cycles. Delays in applying available patches directly translate into open windows for attackers to gain deep, persistent control.
Tactical Insight
Immediate actions
- Apply the latest vendor-supplied patches for Zyxel GS1900 switches and Veeam Agent for Windows without delay.
- Add both CVEs to your internal vulnerability tracking system and verify patch status across all affected assets within 24–48 hours.
- Restrict LAN-side access to Zyxel management interfaces using firewall rules or ACLs to limit exposure until patching is complete.
Long-term improvements
- Maintain a continuously updated asset inventory that includes network appliances, switches, and backup agents to ensure no device is overlooked during patch cycles.
- Establish an emergency patching SLA (e.g., 24–72 hours) triggered automatically when CISA adds a vulnerability to the KEV catalog.
- Enforce least-privilege principles for local accounts on Windows endpoints to limit the blast radius of local privilege escalation exploits.
Detection measures
- Monitor network switches and backup agent logs for anomalous command execution, privilege changes, or unexpected process spawning.
- Deploy network-based intrusion detection rules targeting exploit patterns associated with CVE-2026-7273 and CVE-2026-32996.
- Integrate threat intelligence feeds (e.g., CISA KEV catalog) into your vulnerability scanner to automatically flag actively exploited CVEs for priority remediation.