Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

CISA added a high-severity stack-based buffer overflow in Zyxel GS1900 switches (CVE-2026-7273, CVSS 8.8) to its KEV list after GreyNoise reported active exploitation since Aug 17, 2026 that exfiltrated configs and hashed root credentials from 996 devices across 48 countries; the actor (suspected Chinese-speaking, possibly linked to 'Red Heron') used obfuscated Python and TFTP to deploy a collector. The report additionally warns of active exploitation of a Veeam Agent local privilege escalation (CVE-2026-32996) and notes the adversary has exploited numerous other product vulnerabilities, prompting remediation directives for affected agencies.