CISA Issues Emergency Directive to Patch Actively Exploited Zyxel GS1900 Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive requiring federal agencies to patch a high-severity vulnerability in Zyxel GS1900 series switches. According to CISA, the flaw is being actively exploited in the wild and is being leveraged by attackers for data theft purposes. The emergency directive was issued on September 22, 2026, and requires federal agencies to remediate the vulnerability by a forthcoming Thursday deadline. Zyxel GS1900 series switches are used across federal government networks and globally. The source indicates that active exploitation has been confirmed, though specific technical details of the exploit methodology and the full scope of affected federal systems remain limited in the available reporting. The directive underscores the urgency of the situation given the active exploitation status and the potential for unauthorized access and data exfiltration.