Zyxel GS1900 switch zero-day CVE-2026-107441 bypasses June patch

Zyxel GS1900 series switches that received the June fix for CVE-2026-7273 were still open to the exploit attackers used in the wild, because that exploit targeted a different flaw, CVE-2026-107441. According to Help Net Security, security firm Binarly confirmed the exploit gave unauthenticated command execution on all ten firmware releases that carried the June patch. Zyxel has since shipped a fix in the 2.90 Patch 3 releases.

What happened with the Zyxel GS1900 vulnerability

In June 2026 Zyxel published an advisory for CVE-2026-7273, a stack-based buffer overflow in the CGI program of GS1900 firmware. GreyNoise later reported that a Chinese-speaking threat actor used it to compromise nearly 1,000 devices across 48 countries and to take configuration data, network information and hashed root-level credentials. CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-09-21 with a due date of 2026-09-24.

Binarly, which was analysing malware tied to the same attacker, found an exploit bundle on the attacker’s command server. When it tested the script against switches carrying the June fix, the script still worked. SecurityWeek reports that the attackers did not rely on CVE-2026-7273 at all; they used a previously unknown flaw, now tracked as CVE-2026-107441. Binarly told Zyxel on September 29. Zyxel confirmed the new bug about two weeks later and published its advisory on November 3.

We are covering this now because the November 3 advisory and new reporting show that the attacker used a different flaw from the one in the September KEV entry.

Am I affected by CVE-2026-107441?

The flaw affects 10 GS1900 switch models, according to SecurityWeek. The related June flaw (Zyxel June advisory) lists these models:

• GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16
• GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2
• GS1900-48, GS1900-48HPv2

Help Net Security states that any GS1900 switch running a 2.90 Patch 2 build, written (XXXX.2)C0, or earlier is vulnerable. NVD describes CVE-2026-107441 as affecting GS1900-24E firmware through 2.90(AAHK.2)C0 and does not list the other models; the reporting covers all ten. If your switches are on June’s Patch 2 firmware, treat them as vulnerable.

Technical details

• Weakness: out-of-bounds write (CWE-787) in the CGI program; the exploit targets the web management endpoint /cgi-bin/dispatcher.cgi.
• Access needed: an unauthenticated attacker on the adjacent network sends a crafted HTTP request and can potentially run operating system commands. The CVSS vector is AV:A, so this is not described as remotely reachable from the internet by default.
• Severity: CVSS 8.8 (High) in NVD.
• Exploitation: exploited in the wild per Binarly. CISA’s catalog entry covers CVE-2026-7273, not CVE-2026-107441, and the CVE-2026-7273 record is the one with the KEV date above.
• Malware: the attackers deployed variants of the Jitterly and Sixzut malware.

One point where the data differs: the attack vector is adjacent network, yet GreyNoise counted devices in 48 countries. That suggests many management interfaces were reachable from wider networks than intended, though the sources do not say how the attackers reached them.

Why this matters

This section is our analysis, not new reporting. A switch is trusted infrastructure that sees and controls traffic, and the reported theft of hashed root credentials means a compromised unit may expose secrets reused elsewhere. The more practical lesson is process: many teams closed this ticket in June or after the September KEV deadline. A closed ticket based on a version number did not mean the device was safe. Treat GS1900 units as patch-again priority, and within hours if the management interface is reachable from untrusted segments.

What to do

1. Inventory every GS1900 switch and record the exact firmware build.
2. Upgrade to the 2.90 Patch 3 release for your model, as described in the Zyxel advisory of November 3. Take the exact Patch 3 build for each model from the advisory.
3. Restrict the web management interface to a dedicated management VLAN or jump host, and block it from user and guest segments.
4. Because configuration and hashed root credentials were reportedly taken in earlier attacks, rotate administrative passwords and any credentials stored in switch configurations after patching.

Detection and hunting ideas

The sources publish no indicators of compromise, so we list none. Based on the facts above, review web logs and any network telemetry for unexpected requests to /cgi-bin/dispatcher.cgi on switch management addresses, look for new outbound connections from switches, and compare configurations against known-good backups. Devices that ran Patch 2 firmware since August should be considered for a closer check, since GreyNoise dates the earlier compromises to that month.

What we do not know

Zyxel’s advisory text was not available to us, and the sources disagree slightly on the fix date: SecurityWeek says October 23 and Help Net Security says October 22. The attacker has been linked to the group GreyNoise calls Red Heron, but attribution rests on GreyNoise and the researchers’ reporting rather than a vendor statement.

Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.

Related coverage

• BeyondTrust Remote Support zero-day exploited by China-linked APT (CVE-2026-102764)

Sources

• SecurityWeek: Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
• Help Net Security: Patched Zyxel GS1900 switches remained open to in-the-wild exploit
• NVD: CVE-2026-107441
• NVD: CVE-2026-7273
• Zyxel advisory: out-of-bounds write in GS1900 series switches
• CISA KEV catalog entry for CVE-2026-7273
• GreyNoise research referenced by NVD
• Zyxel advisory: stack-based buffer overflow in GS1900 series switches (June 2026)