A stack-based buffer overflow in the CGI program of Zyxel GS1900 series switches (CWE-121) lets a LAN-based, unauthenticated attacker execute OS commands through a crafted HTTP request; NVD rates it 8.8 high (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and it affects GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0. CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) Catalog on 21 September on evidence of active exploitation, which is what raises it above a routine vendor advisory: NVD published the flaw in June 2026, so the exploitation CISA cites is of a patchable, three-month-old defect in edge hardware that commonly sits outside server and endpoint patching cycles.

• CISA KEV alert
• Zyxel security advisory