Vendor security update2026-08-04
Zyxel patches CVE-2026-6837 and CVE-2026-8508 in APs, FWA7, and security routers
Zyxel published a same-day advisory for command injection and captive-portal authentication bypass issues across a broad AP set, the FWA7 line, and the USG LITE 60AX security router, with model-level patched firmware targets instead of vague upgrade guidance.
AffectedMultiple NWA, WAX, and WBE AP families through listed 7.10, 7.30, and 7.35 trains; FWA7 Leaf Plus 7.35(ACQK.0)C0 and earlier; FWA7 Root Plus 7.35(ACQL.0)C0 and earlier; USG LITE 60AX 2.30(ACIP.1)C0 and earlier
Fixed version(s)Listed AP models move to 7.12(...0)C0 or 7.40(...1)C0 by family; FWA7 Leaf Plus 7.40(ACQK.1)C0; FWA7 Root Plus 7.40(ACQL.1)C0; USG LITE 60AX 2.40(ACIP.0)C0 via cloud update in Sep. 2026
Vendor security update2026-08-04
Zyxel fixes CVE-2026-14818 in ZLD firewalls
Zyxel published a ZLD firewall advisory for a path traversal flaw in the configuration-file execution CLI command that could let an authenticated administrator execute a crafted malicious configuration file, with one clean patched target version across ATP and USG FLEX families.
AffectedATP ZLD V4.32 to V5.42 Patch 1, USG FLEX ZLD V4.50 to V5.42 Patch 1, and USG FLEX 50(W) / USG20(W)-VPN ZLD V4.16 to V5.42 Patch 1
Fixed version(s)ATP ZLD V5.43, USG FLEX ZLD V5.43, and USG FLEX 50(W) / USG20(W)-VPN ZLD V5.43
Vendor security update2026-02-24
Zyxel SCR 50AXE security router multi-CVE firmware update
Zyxel published an official firmware advisory that includes the SCR 50AXE security router, with the router patch table moving affected firmware 1.20(ACGN.0)C0 and earlier to fixed version 1.30(ACGN.0)C0.
AffectedSCR 50AXE with firmware 1.20(ACGN.0)C0 and earlier
Fixed version(s)SCR 50AXE 1.30(ACGN.0)C0
Vendor security update2025-11-18
Zyxel SCR 50AXE firmware update for CVE-2025-6599 and CVE-2025-8693
Zyxel published an official security advisory covering Slowloris-style resource consumption and post-authentication command injection issues across several product families, with the SCR 50AXE security router moving from 1.10(ACGN.3)C0 and earlier to fixed firmware 1.20(ACGN.0)C0 via cloud update.
AffectedSCR 50AXE with firmware 1.10(ACGN.3)C0 and earlier
Fixed version(s)SCR 50AXE 1.20(ACGN.0)C0 (updated by cloud)
Vendor security update2025-04-22
Zyxel USG FLEX H privilege escalation security update
Zyxel published a USG FLEX H firewall advisory covering incorrect permission assignment and improper privilege management issues that could let a local attacker escalate privileges; the vendor says patched uOS builds are available.
AffectedUSG FLEX H uOS V1.20 to V1.31
Fixed version(s)uOS V1.32
Vendor security update2025-01-14
Zyxel AP and security router privilege escalation update
Zyxel released patches for a privilege management issue affecting multiple AP models and the USG LITE 60AX security router, with fixed firmware trains and model-specific download paths published in the official advisory.
AffectedMultiple Zyxel AP models, USG LITE 60AX 2.00(ACIP.4) and earlier
Fixed version(s)USG LITE 60AX 2.10(ACIP.0)*, multiple AP models moved to 6.70/7.00/7.10 fixed trains