Zyxel Security Advisories & CVEs

1 advisories tracked · Zyxel Security Advisories via NVD · direct feeds checked every minute; rate-limited backstops use a safe source cadence

Android app · Google Play

Monitor Zyxel CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Get CVE alerts See app features

Check if your Zyxel device is affected

Pick your product and enter the exact software release it runs. We match it against the affected/fixed versions in Zyxel's recent advisories.

Official source

Zyxel Security Advisories via NVD

Zyxel runs its own CNA (security@zyxel.com.tw), but a large share of Zyxel CVEs are assigned by MITRE and third-party researchers — so VulniPulse ingests them from NVD by keyword (which covers more than the CNA feed alone), requiring a Zyxel product in the description, and links back to the zyxel.com security advisory when referenced. Covers the USG FLEX / ATP / VPN firewalls, Nebula-managed access points, the GS-series switches and the VMG/EMG gateways — an SMB fleet that is a chronic KEV / actively-exploited target.

Visit Zyxel security advisories Zyxel RSS feed Zyxel end-of-life dates(4 product families)

Latest Zyxel advisories

All severities critical high medium low

All platforms Firewalls (USG FLEX/ATP)Nebula / Access Points Switches (GS-series)Gateways (VMG/EMG)

Critical9.8Zyxel

Critical [CVE-2026-13206] Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026.