The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a high-severity flaw in Zyxel GS1900 series smart managed switches to its Known Exploited Vulnerabilities (KEV) catalog on Monday, 21 September 2026, citing evidence of live attacks. On the same news cycle, incident-response firm Arctic Wolf warned that a separate local privilege-escalation bug in Veeam Agent for Microsoft Windows is also under active exploitation, giving attackers who already have a foothold a path to full SYSTEM control. Together, the two disclosures push edge networking gear and endpoint backup agents—both ubiquitous in Nordic and European small-to-medium enterprises—onto the urgent remediation list for security teams.
The Zyxel issue is tracked as CVE-2026-7273 and carries a CVSS 3.1 score of 8.8. According to Zyxel's June advisory, a stack-based buffer overflow in the switch's web-management CGI program lets a LAN-adjacent, unauthenticated attacker send a crafted HTTP request and execute arbitrary operating-system commands. CISA has not named the operators behind the observed exploitation, nor disclosed how many organizations were hit or what attackers did after gaining control. Federal civilian agencies under Binding Operational Directive 26-04 must apply the vendor patches by 24 September 2026—a three-day window that underscores how seriously CISA treats confirmed switch compromise.
Affected models include GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48 and GS1900-48HPv2 on firmware 2.90(xxxx.1)C0 and earlier. Fixed builds ship as 2.90(xxxx.2)C0 for each corresponding branch. Ownership of a network switch is strategically valuable: an attacker who runs commands on the device can mirror traffic, alter VLAN isolation, disable logging, and pivot deeper into corporate or industrial segments. GreyNoise researchers separately reported that a Chinese-speaking actor has recently targeted Zyxel GS1900 switches among other edge technologies while stealing documents from government and small-business victims—an overlap that raises the stakes for any organisation still running vulnerable firmware.
Veeam Agent: from local user to SYSTEM
Arctic Wolf's alert covers CVE-2026-32996 (CVSS 7.3), a local privilege-escalation vulnerability in Veeam Agent for Microsoft Windows. The flaw sits in how the Veeam Endpoint Backup service handles elevated client sessions over the local gRPC named pipe `\\.\pipe\Veeam\VAW\ServiceConnectionPipe`. The service caches an elevated administrator principal against a client-controlled session UID that is not bound to the requesting user or connection. Those elevated session UIDs are written to a log file under `C:\ProgramData\Veeam\Endpoint\` that standard users can read. An attacker who recovers a valid UID can abuse it to execute commands as SYSTEM. A public proof-of-concept on GitHub demonstrates the issue by running `whoami` and writing the output to disk.
Unlike the Zyxel bug, Veeam requires prior local access. In practice that means the flaw is most dangerous as a post-compromise escalator: ransomware crews, initial-access brokers, and advanced persistent threat operators who already land on a workstation via phishing or a stolen credential can use it to disable security tools, dump credentials, and move laterally with SYSTEM privileges. Backup agents are often installed widely and trusted by defenders—making them attractive for living-off-the-land style abuse.
What organisations should do now
Security and IT teams should treat both issues as operational emergencies, not routine patch cycles.
- Patch Zyxel GS1900 switches immediately to the fixed 2.90(xxxx.2)C0 firmware for each model. Isolate management interfaces from untrusted LAN segments; never expose switch CGI/HTTP administration to the open internet.
- Update Veeam Agent for Windows to the vendor-fixed release as soon as it is available in your channel, and restrict who can log on locally to backup-managed endpoints.
- Hunt for compromise before and after patching. On switches, review configuration diffs, unexpected VLAN or mirroring changes, and anomalous management-plane HTTP requests. On Windows hosts with Veeam Agent, look for unusual gRPC named-pipe activity, unexpected SYSTEM processes spawned from the Veeam service context, and reads of `Svc.VeeamEndpointBackup.log` by non-admin users.
- Assume LAN adjacency is enough for Zyxel. Guest Wi-Fi, contractor laptops, and compromised IoT devices on the same broadcast domain can reach the CGI interface if management is not segmented.
- Document the evidence chain. Preserve switch configs, Windows event logs, and Veeam service logs before remediation so digital forensics and incident response teams can determine whether exploitation preceded the patch.
Evidence status
- Confirmed: CISA added CVE-2026-7273 to the KEV catalog based on active exploitation evidence; Zyxel published firmware fixes; Arctic Wolf reported active exploitation of CVE-2026-32996 with a public PoC.
- Reported: Trade press including The Hacker News summarised both campaigns; GreyNoise linked related Zyxel exploitation to broader document-theft activity.
- Unconfirmed: Attribution for the Zyxel KEV exploitation, exact victim counts, and whether the same operators abuse both product families remain open.
In brief
- CISA listed Zyxel GS1900 CVE-2026-7273 in KEV after confirming in-the-wild command execution against smart managed switches; federal remediation is due 24 September 2026.
- Arctic Wolf warns that Veeam Agent for Windows CVE-2026-32996 is actively exploited to escalate local users to SYSTEM via a mishandled elevated session UID.
- Nordic and European organisations running GS1900 switches or Veeam endpoint agents should patch, segment management access, and hunt for pre-patch compromise now.