Analista SOC: 2026-09-22

1. CISA Adds One Known Exploited Vulnerability to Catalog

   CISA, 2026-09-21. Leer, 2 min.

   CISA added CVE-2026-7273, a stack-based buffer overflow in the CGI program of Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities catalog on September 21, 2026, based on evidence of active exploitation. Zyxel’s advisory of June 16, 2026 describes the flaw as letting a LAN-based, unauthenticated attacker potentially execute operating-system commands through a crafted HTTP request, and lists patched firmware for each affected GS1900 model.

   Por qué importa para este rol: You keep watch across the environment, so a new KEV entry for a Zyxel switch flaw under active exploitation is a signal to confirm any GS1900 devices are on the June 16, 2026 firmware.

2. From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies

   Palo Alto Networks Unit 42, 2026-09-21. Leer, 21 min.

   Unit 42 traces the versions of the AWSCompromisedKeyQuarantine managed policy that AWS attaches automatically to an IAM user whose access key appears in a public GitHub repository, and reports that in its own test the AWSCompromisedKeyQuarantineV3 policy was attached within 10 seconds of the key being pushed. It notes that the CloudTrail record of that attachment listed the affected IAM user’s own name in the userIdentity field rather than showing an automated AWS action.

   Por qué importa para este rol: When an AWS access key leaks, an AttachUserPolicy event naming the AWSCompromisedKeyQuarantine policy will cross your queue, and knowing it is AWS locking the key down helps you triage it rather than chase it as an attacker action.

Analista SOC