UPDATE — 7 November 2026: Zyxel's advisory now lists the exact Patch 3 build for each of the ten affected GS1900 models. Any switch still on a .2C0 build or earlier is vulnerable, even if it installed the June update in good faith. Install the build for your model from Zyxel's advisory page, then verify the version number changed after the reboot.
| Model | Install this build (Patch 3) |
|---|---|
| GS1900-8 | 2.90(AAHH.3)C0 |
| GS1900-8HP | 2.90(AAHI.3)C0 |
| GS1900-10HP | 2.90(AAZI.3)C0 |
| GS1900-16 | 2.90(AAHJ.3)C0 |
| GS1900-24 | 2.90(AAHL.3)C0 |
| GS1900-24E | 2.90(AAHK.3)C0 |
| GS1900-24EP | 2.90(ABTO.3)C0 |
| GS1900-24HPv2 | 2.90(ABTP.3)C0 |
| GS1900-48 | 2.90(AAHN.3)C0 |
| GS1900-48HPv2 | 2.90(ABTQ.3)C0 |
Severity dispute: Zyxel and NVD rate CVE-2026-107441 at 8.8 (a LAN-based attacker); Binarly, which found the flaw, rates it 9.8 (a network attacker).
Canada's Centre for Cyber Security (alert AV26-1114, Update 1, 4 November) says open-source reporting indicates the flaw is exploited in the wild. Zyxel's own advisory does not itself claim exploitation, and the flaw was still not in CISA's Known Exploited Vulnerabilities catalogue as of 5 November.
Don't confuse it with a second Zyxel flaw: Zyxel also published a 3 November advisory for CVE-2026-76955, a buffer overflow in the zdp_wtp binary of certain access points, FWA7 devices and security routers (42 models, rated 8.8). That is a different flaw, unrelated to the GS1900 switches.
One caveat on the numbers: the 996-switch figure is GreyNoise's count for the campaign it originally attributed to CVE-2026-7273; Binarly later showed the exploit used in that campaign targeted this new flaw instead.
Sources for this update: Zyxel advisory (3 November 2026) · Binarly (3 November 2026) · The Hacker News (5 November 2026)
Illustrative image: network server infrastructure — the kind of always-on equipment the Zyxel GS1900 switches sit alongside. This is NOT a Zyxel switch. Image: Wikimedia Commons.
TL;DR — Zyxel GS1900 zero-day CVE-2026-107441 explained in one line: attackers hacked 996 of Zyxel's GS1900 network switches in 48 countries using a flaw nobody knew about — and the June security patch everyone trusted did not stop it, because the exploit targeted a second, separate bug hiding in the same web interface. Zyxel shipped the real fix on 22 October and published its advisory on 3 November 2026.
📌 KEY HIGHLIGHTS
- The flaw: CVE-2026-107441, an out-of-bounds write bug in the GS1900 switches' web management interface, letting an unauthenticated attacker with network access run operating-system commands.
- The scale: 996 switches compromised across 48 countries from around 17 August 2026, with device configurations, hashed root passwords and network details stolen.
- The twist: everyone blamed a June flaw (CVE-2026-7273) that Zyxel had already patched — but the exploit kept working on all ten June-patched firmware releases, because it attacked a different bug.
- The fix: new Zyxel firmware released 22 October 2026, with the advisory published 3 November 2026. If you run a GS1900, that update is the one that matters.
- The uncomfortable detail: 564 of the hacked switches still ran factory default credentials — the attackers did not always need to be clever.
What happened?
Zyxel's GS1900 series are smart managed network switches — the boxes that connect computers, servers and access points inside offices and small data centres. On 3 November 2026, Zyxel published a security advisory for a flaw in their web management interface, the browser page administrators use to configure the switch. Tracked as CVE-2026-107441, it is an out-of-bounds write flaw: by sending specially crafted HTTP requests, an attacker with network access to the switch — no username, no password — can corrupt memory and execute operating-system commands on the device.
That alone would be a serious patch notice. What makes this story worth a post is the timeline, because the attacks started months before anyone knew this flaw existed — and the industry spent weeks blaming the wrong bug.
Zyxel GS1900 zero-day CVE-2026-107441 explained: the patch that didn't stop it
The story starts on 16 June 2026, when Zyxel released firmware fixing CVE-2026-7273, a pre-authentication buffer overflow in the same GS1900 switches. Then, from around 17 August, security firm GreyNoise watched a suspected Chinese-speaking threat actor it calls Kapibala breaking into GS1900 switches. By GreyNoise's count, the actor compromised 996 devices in 48 countries — Italy, the United States, Taiwan and South Korea among the hardest hit — and after gaining command execution, each switch downloaded a script that copied out its configuration, network information and the hashed password of the root account. GreyNoise linked Kapibala to the Red Heron hacking campaign, previously reported by Acronis in connection with attacks on the self-hosted code platform Gitea.
When GreyNoise disclosed the campaign on 21 September 2026, it attributed the exploitation to CVE-2026-7273, the flaw Zyxel had patched in June — and CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalogue the same day. On that reading, the lesson was simple: patch your switches. But the reading was wrong.
Firmware security firm Binarly found the truth while investigating Red Heron infrastructure linked to the JITTERLY backdoor and SIXZUT rootkit: an exposed archive containing an obfuscated Python exploit built specifically for GS1900 switches. Analysing it, Binarly found the exploit actually checked that the target was running firmware patched for CVE-2026-7273 — and on 28 September confirmed it still worked against all ten June-patched firmware releases. The June fix had added checks to prevent a buffer overflow, but attackers could corrupt a parameter counter before it was validated, overwriting memory and running commands without authentication even on "patched" switches. Binarly reported its findings to Zyxel on 29 September; Zyxel confirmed the new flaw on 11 October and assigned it CVE-2026-107441, classifying it as a separate vulnerability because the exploit also abused missing validation of HTTP parameter lengths. Whether the exploit was deliberately built to bypass the June updates, or simply exploited a related flaw the June patches missed, is still unclear.
| Date | What happened | Why it matters |
|---|---|---|
| 16 June 2026 | Zyxel patches CVE-2026-7273 in GS1900 switches | The fix everyone trusted — but it addressed only the first flaw |
| ~17 Aug 2026 onwards | GreyNoise observes Kapibala exploiting GS1900 switches; 996 devices in 48 countries compromised | Configs, hashed root passwords and network details stolen |
| 21 Sept 2026 | GreyNoise discloses the campaign, blaming CVE-2026-7273; CISA adds CVE-2026-7273 to KEV | The wrong flaw got the official warning |
| 28 Sept 2026 | Binarly confirms the recovered exploit works against all ten June-patched firmware releases | Proof the June patch did not stop the attacks |
| 29 Sept / 11 Oct 2026 | Binarly reports to Zyxel; Zyxel confirms the new flaw as CVE-2026-107441 | A separate vulnerability, not a repeat of CVE-2026-7273 |
| 22 Oct / 3 Nov 2026 | Zyxel releases fixed firmware; advisory published | The update that actually closes the hole |
Illustrative image: server racks in a data centre — the infrastructure that switches like the GS1900 keep connected. Image: Wikimedia Commons, CC0.
Why it matters for World Tech readers
Switches are invisible infrastructure, which is exactly why this story matters beyond the 996 victims. A compromised switch sits in the middle of a network: it can see traffic, hand over credentials, and give an attacker a quiet foothold for the next stage of an intrusion. The stolen hashed root passwords are the long tail here — hashes can be cracked offline, and a root password reused anywhere else becomes a second breach waiting to happen.
There is also a lesson for anyone who manages network gear, at home or at work: "patched" is a claim about a specific flaw, not a guarantee. The June update was real and it fixed a real bug — it just was not the bug being exploited. And the 564 switches still on factory default credentials are a reminder that the most embarrassing findings in breach reports are usually the most basic: change the default password, and do not expose a switch's management page to networks that do not need it. For the pattern of exploited flaws with hard deadlines, see our DreamHost breach coverage and our WS_FTP Server critical flaw explainer — both show the same rule: confirmed exploitation beats a severity score as a reason to act.
Should you care?
✅ Yes — if you run, manage or rely on a Zyxel GS1900 switch. Install the 22 October firmware now, change any factory default credentials, and treat a switch that was reachable during the August–October window as potentially compromised: review its configuration, rotate credentials and check logs. ⏳ If you don't run Zyxel gear, the takeaway is still useful: a patch notice is only as good as the flaw it names, and default passwords remain the cheapest way into a network.
What to do now
First, check your model against Zyxel's 3 November advisory and install the 22 October firmware release for that model — the June firmware is not enough. Second, change the admin and root credentials if they are still factory defaults, and rotate any credential that might have been stored on or passed through the switch. Third, if the switch's management interface was reachable from untrusted networks, review its configuration for changes you did not make and look for unexpected outbound connections or scripts. Note carefully: CISA's KEV entry from September covers the older CVE-2026-7273, not CVE-2026-107441 itself — do not let the absence of a KEV listing for the new flaw slow you down; exploitation of it is already confirmed by GreyNoise's victim count and Binarly's exploit analysis.
FAQs
What is CVE-2026-107441? It is an out-of-bounds write flaw in the web management interface of Zyxel's GS1900 series switches. An unauthenticated attacker with network access can send crafted HTTP requests to run operating-system commands on the switch, without needing any login.
How many Zyxel switches were hacked? GreyNoise counted 996 GS1900 switches compromised across 48 countries, starting around 17 August 2026. The attackers stole device configurations, hashed root account passwords and network information from each one.
Does the June 2026 Zyxel patch protect against this zero-day? No. The June patch fixed a different flaw, CVE-2026-7273. Binarly proved the recovered exploit still worked against all ten June-patched firmware releases. Only the firmware Zyxel released on 22 October 2026 closes CVE-2026-107441.
What firmware fixes CVE-2026-107441? The firmware updates Zyxel released on 22 October 2026, which limit parameter sizes and validate the parameter count before data is copied into memory. Check Zyxel's 3 November advisory for the exact version for your GS1900 model, and change any factory default credentials at the same time.
Takeaway: A patch is only a fix for the flaw it names — Zyxel's June update was real, but the attackers were using a second, unknown bug all along. The 22 October firmware is the one that actually closes the hole.
Follow World Tech on TechByCountry for tomorrow's update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
- BleepingComputer — Zyxel fixes zero-day exploited to hack nearly 1,000 network switches (4 Nov 2026)
- Cryptika — Hackers exploit Zyxel GS1900 zero-day in the wild (Binarly findings, CVSS and dispatcher.cgi detail)
- Carthage Electronics — November 4 2026 CVE Threat Brief (KEV status, affected firmware, zero-day confirmation)
Comments
Post a Comment