On 21 September 2026, CISA added the critical CVE-2026-7273 vulnerability in Zyxel GS1900 switches to the Known Exploited Vulnerabilities (KEV) catalog, setting 24 September 2026 as the remediation deadline for federal agencies. At the same time, Arctic Wolf reported active exploitation of the CVE-2026-32996 vulnerability in Veeam Agent for Windows, which allows privilege escalation to SYSTEM level. Both vulnerabilities have vendor patches available, and organizations using affected products need to apply updates as soon as possible.
CVE-2026-7273: buffer overflow in Zyxel GS1900 switches
The CVE-2026-7273 vulnerability is a stack-based buffer overflow (CWE-121) in a CGI program in the firmware of Zyxel GS1900 series switches. According to the Zyxel advisory, an unauthenticated attacker on the local network can execute arbitrary operating system commands via a specially crafted HTTP request. The CVSS score is 8.8 (High) according to the GitHub Advisory entry.
The key aspect of this vulnerability is that it does not require authentication. An attacker only needs access to the local network where the vulnerable switch operates. Given that GS1900 series switches are entry-level managed devices widely used in small and medium-sized businesses, the attack surface may be significant.
Ten switch models are affected:
- GS1900-8 — versions 2.90(AAHH.1)C0 and earlier, fixed in 2.90(AAHH.2)C0
- GS1900-8HP — versions 2.90(AAHI.1)C0 and earlier, fixed in 2.90(AAHI.2)C0
- GS1900-10HP — versions 2.90(AAZI.1)C0 and earlier, fixed in 2.90(AAZI.2)C0
- GS1900-16 — versions 2.90(AAHJ.1)C0 and earlier, fixed in 2.90(AAHJ.2)C0
- GS1900-24 — versions 2.90(AAHL.1)C0 and earlier, fixed in 2.90(AAHL.2)C0
- GS1900-24E — versions 2.90(AAHK.1)C0 and earlier, fixed in 2.90(AAHK.2)C0
- GS1900-24EP — versions 2.90(ABTO.1)C0 and earlier, fixed in 2.90(ABTO.2)C0
- GS1900-24HPv2 — versions 2.90(ABTP.1)C0 and earlier, fixed in 2.90(ABTP.2)C0
- GS1900-48 — versions 2.90(AAHN.1)C0 and earlier, fixed in 2.90(AAHN.2)C0
- GS1900-48HPv2 — versions 2.90(ABTQ.1)C0 and earlier, fixed in 2.90(ABTQ.2)C0
CISA has not disclosed who is behind the exploitation, when it began, how many organizations have been attacked, or what actions were taken after compromise. At the time of publication, Zyxel had also not updated its advisory to confirm active exploitation.
CVE-2026-32996: privilege escalation in Veeam Agent for Windows
The CVE-2026-32996 vulnerability is a local privilege escalation in Veeam Agent for Microsoft Windows. According to the Veeam advisory, the vulnerability is rated High with CVSS v4.0 7.3. The weakness is classified as CWE-532 (Insertion of Sensitive Information into Log File), according to the GitHub Advisory entry.
The exploitation mechanism merits special attention. The Veeam Endpoint Backup service processes privileged client sessions via a named gRPC pipe (\\.\pipe\Veeam\VAW\ServiceConnectionPipe). The service caches a privileged administrator identifier bound to a session UID controlled by the client, which is not tied to the requesting user or connection. These UIDs are written to the log file C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log, which is readable by regular users. An attacker can extract a valid UID from the log and use it to execute commands with SYSTEM privileges.
All Veeam Agent for Windows version 13 builds are affected, including 13.0.1.2067 and earlier. According to Arctic Wolf, technical details and exploit (PoC) code for this vulnerability were published on 14 September 2026, significantly increasing the likelihood of attacks. Arctic Wolf also reports observing multiple stages of the exploitation chain, although there is still no independent confirmation of the scale of exploitation from other researchers.
We have already written about vulnerabilities in Veeam products in our August 2026 patch overview. The current vulnerability affects a different component — the agent for Windows — but underscores the need for a comprehensive approach to updating the entire Veeam ecosystem.
Prioritization and recommendations
The two vulnerabilities have fundamentally different impact boundaries, which determines the response order:
CVE-2026-7273 (Zyxel) — a priority for organizations subject to CISA KEV requirements (U.S. federal agencies), with a remediation deadline of 24 September 2026. For other organizations: the vulnerability is exploited from the local network without authentication, which makes it critical in environments where network access to the switch management interface is not restricted. You should update the firmware to the fixed versions listed in the Zyxel advisory.
CVE-2026-32996 (Veeam) — a priority for environments with shared workstations, terminal servers, and any endpoints where low-privileged users have local access to systems with Veeam Agent installed. The availability of a public PoC and confirmed exploitation (according to Arctic Wolf) makes delaying the update risky. You should update Veeam Backup & Replication to version 13.0.2.29, which, according to Arctic Wolf, also updates the Windows agent to build 13.0.3.1220.
Additional measures:
- Restrict access to Zyxel GS1900 switch management interfaces from shared network segments
- Check access permissions for Veeam Agent log files on endpoints before applying the update
- Monitor attempts to execute commands via the Veeam named pipe on endpoints
Both vulnerabilities have vendor patches available. For CVE-2026-7273, inclusion in the CISA KEV catalog confirms active exploitation and sets a strict response deadline. For CVE-2026-32996, the presence of a public PoC since 14 September and Arctic Wolf’s reports of exploitation mean the window for safe updating is narrowing. Action priorities: update the firmware of affected Zyxel switches and update Veeam Backup & Replication to 13.0.2.29 on all managed endpoints.
