Our takeBinarly reports a pre-auth RCE zero-day in the Zyxel GS1900 switch exploited in the wild by JITTERLY and SIXZUT; GreyNoise and CISA KEV had linked it to CVE-2026-7273. Patch immediately if you run these switches.Security Resilience desk
Sources (4)
- binarly · binarly
- hackernews · hackernews
- securityweek · securityweek
- helpnet · helpnet
What this means for you — Security leader:Apply the vendor patch for CVE-2026-7273 immediately on all GS1900 switches; the pre-auth RCE is under active exploitation as a zero-day by the JITTERLY actor group.
What this means for you — Lean IT orgs:If you use a Zyxel GS1900 switch, check with your vendor or MSP right away for the security update; this zero-day remote code exploit is already being used in the wild.
What this means for you — MSP:Confirm every client GS1900 switch has the latest firmware applied for CVE-2026-7273; the pre-auth RCE is exploited in the wild by the JITTERLY actor.
What this means for you — Researcher:Examine the Binarly technical write-up and linked GreyNoise/CISA data on the JITTERLY/SIXZUT exploit chain for CVE-2026-7273 and the zero-day variant.