Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

Attackers are actively exploiting a stack-based buffer overflow in Zyxel GS1900 switches that allows unauthenticated LAN-based attackers to execute OS commands, and a local privilege escalation flaw in Veeam Agent for Windows that grants SYSTEM-level control. Both vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog, signaling confirmed, real-world abuse. The Zyxel flaw is particularly dangerous because it requires no authentication, meaning any device on the local network segment can serve as an attack origin. Together, these flaws highlight the compounding risk of unpatched network infrastructure and endpoint backup agents — two asset classes that are often deprioritized in patch cycles. Delays in applying available patches directly translate into open windows for attackers to gain deep, persistent control.