Zyxel and Veeam flaws under active exploitation: check the firewall and backup server of your Mexico operation today

On September 22, 2026, two warnings landed the same day. The Hacker News reported active exploitation of a flaw in Zyxel firewalls and routers and of another in Veeam, the most common backup software for virtualized servers. The Veeam one hands over SYSTEM access, the most powerful account on a Windows machine. Whoever holds it owns the box.

To round it off, D-Link warned of a max severity zero-day in its DIR-822A routers, a flaw attackers use before a patch exists. If your Mexico plant or branch sits behind a Zyxel and a Veeam server backs up its VMs, read this today, not Friday.

Why the backup server is the first target

Ransomware is a kidnapping of your files. They get encrypted and you are asked to pay for the key. The only defense that lets you refuse is a clean copy somewhere else. Attackers know that.

In our experience a well-run attack goes in this order: get in through the perimeter, move to the backup server, wipe or encrypt the copies, and only then hit production. By the time the accountant at the Querétaro office sees the red screen, the backups have been gone for days.

A Veeam flaw with SYSTEM access is that second step handed over on a plate. The Zyxel flaw is the first. This week they showed up together.

How to check the Zyxel units at your Mexico sites

A firewall is the box that decides what goes in and out of your network. At Mexican branches it is often a Zyxel installed by a local integrator years ago, with credentials nobody at headquarters has ever seen. That is the risk.

BleepingComputer reported that CISA, the US cybersecurity agency, ordered federal agencies to patch the Zyxel flaw by Thursday because it is already being used to steal data. When CISA sets a deadline, it is not a suggestion.

What to do: log in to each unit, note model and firmware version (the software inside the device) and compare it with the vendor advisory. Three sites means three boxes. If a unit no longer gets updates, replace it. While you are in there, confirm remote management is not open to the whole internet, the same mistake we keep finding with exposed IP cameras.

How to check Veeam today

Veeam is the software that copies your servers and virtual machines (VMs, servers that live inside another server). Its console is the screen everything is managed from. Three things for today:

Step	What to do	How you know it is done
Version	Open the console, go to Help › About and note the version	It matches the one Veeam already fixed
Isolate	The console must not be reachable from the internet or the user network	Only IT gets in, over VPN or a separate network
Access	Review users, passwords and open sessions on the server	Nothing you do not recognize, MFA turned on

And one thing almost nobody does: test a restore. A backup that has never been restored is a promise, not a backup. We cover it in backups that actually restore.

The D-Link router at the two-person office

The D-Link warning covers the DIR-822A model and there was no patch when this was written. If one sits in a warehouse or a tiny sales office in Mexico, the sane move is to replace it with a unit that still gets support. That costs an afternoon. A ransomware payment does not.

How this fits a support plan

At ProcessBi this is not handled as an emergency, it is handled as routine. Inside an IT support plan we keep an inventory of the perimeter equipment at each Mexico site (brand, model, version), schedule patching outside production hours and, every so often, restore a real backup to prove it works. Reports go to your IT team abroad, in English.

When a warning like today’s comes out, we already know how many Zyxel units you have and what version they run. That is the difference between a quiet morning and an ugly weekend.

Let’s talk

And in your Mexico operation?

If nobody can tell you what firmware the branch firewall runs or when a backup was last restored, you already have your answer. We check it at no cost and tell you what to patch first.

Book your free assessment — we reply the same business day.