CVE-2026-7273: listed in the CISA KEV catalog CVE-2026-7273 · CVSS 8.8 HIGH · EPSS 3% · KEV 2026-09-21
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Is CVE-2026-7273 exploited? Listed in the CISA KEV catalog on 2026-09-21. Federal remediation due 2026-09-24. Past that date by 50 days. EPSS puts exploitation in the next 30 days at 3%. Public exploit code: none found in monitored sources. Which products and versions are affected? Zyxel · GS1900-48HPv2 firmware · <= 2.90(ABTQ.1)C0 Zyxel · GS1900-8 firmware · <= 2.90(AAHH.1)C0 Zyxel · GS1900-8HP firmware · <= 2.90(AAHI.1)C0 Zyxel · GS1900-10HP firmware · <= 2.90(AAZI.1)C0 Zyxel · GS1900-16 firmware · <= 2.90(AAHJ.1)C0 Zyxel · GS1900-24 firmware · <= 2.90(AAHL.1)C0 Zyxel · GS1900-24E firmware · <= 2.90(AAHK.1)C0 Zyxel · GS1900-24EP firmware · <= 2.90(ABTO.1)C0 Zyxel · GS1900-24HPv2 firmware · <= 2.90(ABTP.1)C0 Zyxel · GS1900-48 firmware · <= 2.90(AAHN.1)C0 Is there a patch? Zyxel's record doesn't name a fixed version.
Zyxel advisory
What PlainSec published about CVE-2026-7273 Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-11-06.
CVE-2026-7273: listed in the CISA KEV catalog CVE-2026-7273 · CVSS 8.8 HIGH · EPSS 3% · KEV 2026-09-21
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Is CVE-2026-7273 exploited? Listed in the CISA KEV catalog on 2026-09-21. Federal remediation due 2026-09-24. Past that date by 50 days. EPSS puts exploitation in the next 30 days at 3%. Public exploit code: none found in monitored sources. Which products and versions are affected? Zyxel · GS1900-48HPv2 firmware · <= 2.90(ABTQ.1)C0 Zyxel · GS1900-8 firmware · <= 2.90(AAHH.1)C0 Zyxel · GS1900-8HP firmware · <= 2.90(AAHI.1)C0 Zyxel · GS1900-10HP firmware · <= 2.90(AAZI.1)C0 Zyxel · GS1900-16 firmware · <= 2.90(AAHJ.1)C0 Zyxel · GS1900-24 firmware · <= 2.90(AAHL.1)C0 Zyxel · GS1900-24E firmware · <= 2.90(AAHK.1)C0 Zyxel · GS1900-24EP firmware · <= 2.90(ABTO.1)C0 Zyxel · GS1900-24HPv2 firmware · <= 2.90(ABTP.1)C0 Zyxel · GS1900-48 firmware · <= 2.90(AAHN.1)C0 Is there a patch? Zyxel's record doesn't name a fixed version.
Zyxel advisory
What PlainSec published about CVE-2026-7273 Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-11-06.