Zyxel vulnerabilities and fixes

CVEs that mention Zyxel, ranked by priority. 7 tracked.

Zyxel has 7 tracked vulnerabilities, 1 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 4. Most recent: 2026-08-10. Highest priority: CVE-2026-7273 (score 82/100).

• CVE-2026-7273 HIGH 8.8 EXPLOITED MITIGATE MITIGATE Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
• CVE-2026-13206 CRITICAL 9.8 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zy
• CVE-2026-6837 HIGH 7.2 A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmwar
• CVE-2026-12984 HIGH 8.2 Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitiv
• CVE-2026-6374 HIGH 7.3 Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within a
• CVE-2026-8508 MEDIUM 6.5 An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versi
• CVE-2026-6373 MEDIUM 6.5 Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH

FAQ

How do I fix Zyxel vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Zyxel being exploited right now?

Yes: 1 Zyxel CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which Zyxel CVE should I patch first?

CVE-2026-7273 currently ranks highest (82/100): Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability.

← Back to latest CVEs