Cybersecurity experts are sounding the alarm over a pair of severe vulnerabilities in widely used network devices and software, which hackers are actively exploiting to gain command and system access. The flaws, affecting Zyxel’s firewall appliances and Veeam’s data protection platform, have left thousands of organizations exposed to potential attacks.
The common thread between these two seemingly disparate products is the threat actor’s ability to leverage identity exposure as a springboard for lateral movement within compromised networks. By exploiting vulnerabilities in authentication protocols, hackers can gain access to sensitive systems and escalate privileges with ease, ultimately bypassing traditional security controls and breaching key choke points.
Zyxel’s firewall appliances have been found vulnerable to a remote code execution flaw, which allows attackers to inject malicious code onto the device itself. This vulnerability has significant implications for organizations relying on Zyxel firewalls for network segmentation and access control. Meanwhile, Veeam’s data protection platform is being targeted by an exploit that abuses a weakness in the authentication protocol, enabling hackers to gain System Access and potentially spread malware across the network.
While both vulnerabilities are severe, it’s essential to understand the nuances of how they work to grasp the scope of the threat. The core issue lies in the way these products handle identity and access management (IAM). Hackers are capitalizing on misconfigured or outdated IAM settings to bypass traditional security controls, which is particularly concerning given the widespread adoption of cloud-based infrastructure. Once inside, attackers can then pivot across domains using privilege escalation techniques.
The active exploitation of these vulnerabilities underscores a pressing concern: the ongoing struggle to keep pace with emerging threats in an ever-evolving threat landscape. Organizations must prioritize IAM security and regularly review their configuration settings to prevent such breaches from occurring. This is particularly crucial for those operating in heavily regulated industries, where non-compliance can have severe financial and reputational consequences.
Ultimately, the key takeaway here is that identity exposure remains a potent entry point for sophisticated attackers. As we continue to adopt increasingly complex cloud-based infrastructure, it’s essential that security teams prioritize IAM security and closely monitor their networks for signs of suspicious activity.
Source: The Hacker News — 2026-09-22