The CVSS 7.2 score for CVE-2026-14818 understates the actual risk. The vulnerability is a path traversal in Zyxel ATP, USG FLEX, and USG20-WVPN firewalls that allows an authenticated administrator to load configuration files from outside the intended directory. This becomes critical because Zyxel's CLI treats these config files as executable — they contain directives the firmware parses and acts upon, not merely declarative settings. Path traversal in this context means an attacker escapes the config directory and loads a crafted file that the device will interpret, turning file access into arbitrary command execution.
The version range is significant: affected firmware spans V4.16 through V5.42 Patch 1 across multiple product lines. This multi-year, multi-product spread indicates the vulnerable code path wasn't a one-off mistake but rather a shared architectural pattern that propagated through years of releases without catching in security review. The persistence into relatively recent firmware (Patch 1 of 5.42) raises legitimate questions about what other undocumented execution paths remain in these devices.
These are enterprise security perimeters — ATP and USG FLEX firewalls enforce security policy and often sit inline with decrypted traffic. Compromising one doesn't just give a foothold; it provides a MITM position on sensitive traffic and direct access to internal segments. An attacker with admin credentials (via credential stuffing, insider threat, or a separate initial access) now has a reliable code execution path that appears as normal administrative activity.
Two questions should drive your response. First, verify your firmware version immediately — if you're below the patched version, treat this as priority-one. Second, audit whether your organization actually uses the config file execution feature; if it's unused legacy functionality, the risk calculation shifts toward assuming adversaries may discover and abuse it. The detection challenge is real: malicious config file loading through the CLI likely produces no distinctive logs if the system treats config execution as routine admin behavior. Correlate admin sessions with config file sources during incident response.
The patch-before-disclosure timeline is ambiguous — either Zyxel found this internally (suggesting a gap in their security development lifecycle) or received a private report. Either way, there's likely an unpatched population with no signal that their gateway posture changed.