Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access
Linked advisories
Affected vendors and products
- Zyxel Zyxel GS1900-10HP firmware
- Zyxel Zyxel GS1900-16 firmware
- Zyxel Zyxel GS1900-24E firmware
- Zyxel Zyxel GS1900-24EP firmware
- Zyxel Zyxel GS1900-24 firmware
- Zyxel Zyxel GS1900-24HPv2 firmware
- Zyxel Zyxel GS1900-48 firmware
- Zyxel Zyxel GS1900-48HPv2 firmware
- Zyxel Zyxel GS1900-8 firmware
- Zyxel Zyxel GS1900-8HP firmware
More on Command
Other advisories
- HighCVE-2026-119282@nx/maven and @nx/gradle have OS command injection via nx.json plugin options
- HighCVE-2026-119282@nx/maven and @nx/gradle have OS command injection via nx.json plugin options
- HighCVE-2026-116252pgAdmin 4 fixes 15 CVEs in 9.19, including command execution through Import/Export (CVE-2026-116241) and a login lockout bypass
- Not ratedosv:CVE-2026-119282Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle
- Not ratedosv:CVE-2025-13050Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users
- Not ratedosv:CVE-2026-119025open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows
- HighCVE-2026-113732virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
- HighCVE-2026-113726virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST
Other news entries
- Linux kernel exploit enables remote root attacks on MPTCP serversNewsBleepingComputer
- Critical Linux kernel flaw allows remote root attacks on MPTCP serversNewsBleepingComputer
- Alibaba AI model tried to send data to Beijing server, Cohere saysNewsCSO Online
- NCSC-2026-0454 [1.00] [M/H] Kwetsbaarheden verholpen in HPE Networking AOSNewsNCSC-NL
- You gave your AI agent access, but who is giving it orders?NewsBleepingComputer
- Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted ImageNewsThe Hacker News
- Cisco Patches 34 Vulnerabilities Across Multiple ProductsNewsSecurityWeek
- Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposedBreachpwn.watch
Source: https://thehackernews.com/2026/09/zyxel-and-veeam-flaws-under-active.html
ID