Analysis

Zyxel patches the CVE-2026-107441 zero-day in GS1900 switches, exploited against nearly 1,000 devices

Binarly says the exploit used against nearly 1,000 Zyxel GS1900 switches got past the June fix. Patch 3 closes the CVE-2026-107441 flaw.

By Audryk · November 5, 2026

• #Zyxel
• #GS1900
• #zero-day
• #CVE-2026-107441
• #Binarly
• #GreyNoise
• #CISA

On November 3, 2026, Zyxel published a security advisory for CVE-2026-107441, a flaw in GS1900 switches that Binarly says was exploited as a zero-day against nearly 1,000 devices. A zero-day is a flaw exploited before a fix covers it. The attacks were first attributed to CVE-2026-7273, patched in June; Binarly shows that fix (Patch 2) did not stop the exploit. The firmware that closes the flaw is 2.90 Patch 3, released in late October.

The essentials

• What is established: an out-of-bounds write in the firmware's CGI program lets an unauthenticated attacker run operating-system commands through HTTP requests; Zyxel rates it CVSS 8.8; ten models are affected.
• What to do: install the Patch 3 build for your model. Patch 2 and earlier remain vulnerable, and no workaround is given.
• What is not established: whether Patch 2 was an incomplete fix or the attackers used a different flaw than the one CISA listed. Zyxel's advisory does not say whether the new flaw was exploited.
• A catch: 564 of the 996 compromised switches still used factory-default credentials, according to GreyNoise.

What happened between the June fix and the October one?

• June 16: Zyxel publishes an advisory for CVE-2026-7273 (Patch 2 firmware).
• Around August 17: start of the activity GreyNoise observed against GS1900 switches.
• September 21: GreyNoise publishes its report (996 switches in 48 countries); CISA adds CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) catalog, with a September 24 deadline.
• September 28 and 29: Binarly confirms the exploit works against all ten Patch 2 firmware builds, then reports the flaw to Zyxel, which confirms it on October 11 (BleepingComputer).
• October 22 or 23: Zyxel releases Patch 3. SecurityWeek and The Hacker News say the 23rd; BleepingComputer says the 22nd.
• November 3: Zyxel publishes its advisory and Binarly its report.

Why did the June fix not suffice?

While investigating infrastructure tied to the JITTERLY backdoor, Binarly found an exposed archive containing an obfuscated Python exploit. The exploit checked the firmware version, including builds already patched for CVE-2026-7273. According to Binarly, the flaw is an out-of-bounds write in the web request handler: Patch 2 added a check on the number of parameters, but the size of each HTTP parameter was not properly checked. Zyxel treats that gap as a separate flaw, hence the new CVE. Patch 3 limits parameter sizes and checks their count before copying data into memory.

Binarly offers two readings: Patch 2 was an incomplete fix, or the attacks used a different flaw than the one CISA listed. According to BleepingComputer, it is unclear whether the exploit was built on purpose to bypass the updates or targets a related flaw they failed to fix. Binarly plans to publish a smaller proof of concept.

On severity, Binarly scores it 9.8 and the vendor's NVD entry says 8.8. Zyxel describes an unauthenticated attacker on the local network; Binarly says the attacker only needs network reach of the management service.

Which models are affected, and what should you do?

Each of the ten models below, running Patch 2 firmware or earlier, needs the matching Patch 3 build. The table comes from The Hacker News: check it against Zyxel's advisory.

Zyxel does not say whether updating removes access an attacker already obtained, or how to check whether a switch was compromised. As general practice not found in the advisory, The Hacker News suggests changing factory-default credentials and limiting access to the management interface.

What were the attackers taking?

According to GreyNoise, relayed by The Hacker News, the attackers dropped a collection script that gathered switch configurations, hashed root credentials and network information. GreyNoise links the activity to a Chinese-speaking group that Acronis tracks as Red Heron; Binarly says it saw variants of the Jitterly and Sixzut malware. GreyNoise did not specify the firmware versions targeted or the attack path. At the time of The Hacker News report, CVE-2026-107441 was not in CISA's KEV catalog.

Frequently asked questions

Is my switch protected if it has the June fix?

No, according to Binarly: the exploit works unchanged against Patch 2. Install the Patch 3 build for your model.

Is it really a zero-day?

Binarly and the press describe it that way: exploited before a fix existed. Zyxel treats the flaw as separate from CVE-2026-7273, and its advisory does not say whether it was exploited. Both readings of Patch 2 (a failed fix or a different flaw) remain open.

Method and limits

Sources as of November 5, 2026. We tested nothing and did not read Zyxel's advisory directly; the technical analysis is Binarly's, not independently verified, and the firmware table comes from The Hacker News. Sources differ on the patch date (October 22 or 23) and on severity (8.8 or 9.8).

Sources

• SecurityWeek: Zyxel switch hacks blamed on patched flaw actually exploited a zero-day (verified 2026-11-05)
• BleepingComputer: Zyxel fixes zero-day exploited to hack nearly 1,000 network switches (verified 2026-11-05)
• The Hacker News: Zyxel GS1900 patch fails to block zero-day exploit (verified 2026-11-05)
• Help Net Security: attacker compromised nearly 1000 Zyxel switches since August (verified 2026-11-05)
• Zyxel: security advisory for CVE-2026-7273 (verified 2026-11-05)

Spotted an error in this article? Report it · Our corrections policy