Research

Pre-Auth RCE in Zyxel GS1900 Exploited in the Wild as a Zero-Day

GreyNoise and CISA KEV linked this Zyxel GS1900 exploit to CVE-2026-7273, but it hits a zero-day. We cover the actor, JITTERLY, SIXZUT, and the exploit.

Read at Binarly REsearch

Vendor

Zyxel

EPSS

0.003 (p22)

Exploitation

observed in the wild

• Binarly REsearch (binarly.io)
• CVE-2026-7273 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-107441 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 29
   News SecurityWeek 15h ago

   Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day

   CVE-2026-107441 Zyxel
2. 28
   CCCS advisory CCCS 2d ago

   Zyxel security advisory (AV26-1114)

   CVE-2026-107441 Zyxel
3. 24
   CVE NVD 3d ago

   An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated…

   CVSS 8.8 CVE-2026-107441 Zyxel
4. 16
   Research Insikt Group 24d ago

   September 2026 CVE Landscape

   CVE-2026-88771CVE-2026-88772CVE-2026-35273+57 more
5. 47
   CISA alert CISA 21 Sep 2026

   CISA Adds One Known Exploited Vulnerability to Catalog

   Exploited CVE-2026-7273 Zyxel
6. 57
   KEV CISA KEV 21 Sep 2026

   Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

   KEV · due 24 Sep 2026 (overdue) Fix available CVE-2026-7273 Zyxel