Skip to content
securitytabs

LiveUpdated

Zyxel GS1900 switches hit by exploited flaw that an earlier patch did not fix

Attackers are using a flaw in Zyxel GS1900 network switches, which let them run commands on the device. Switches that got an earlier fix may still be exposed, so organizations using them should check Zyxel's latest advisory now.

Zyxel GS1900 switch flaw exploited after incomplete fix
Zyxel GS1900 switch flaw exploited after incomplete fix

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

Zyxel published a security advisory on November 3, 2026 covering its GS1900 series switches. The flaw, CVE-2026-107441, is an out-of-bounds write (a memory error) that could let an attacker execute operating system commands through crafted HTTP requests, according to SecurityWeek. NVD rates it 8.8 on the CVSS severity scale. [1][2]

Binarly found that GS1900 switches patched for an earlier bug, CVE-2026-7273, remained open to the exploit attackers used, Help Net Security reports. Zyxel's June 2026 advisory on that earlier bug, a stack-based buffer overflow, fixed a different flaw from the one the exploit relies on. [3][2]

Exploitation

Canada's national cyber agency noted in an update on November 4, 2026 that open-source reporting indicates CVE-2026-107441 is exploited in the wild. CISA's Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, does not list it. EPSS, a probability estimate of exploitation, was 0.003 on November 4. [1]

Who is affected

The advisory lists Zyxel GS1900 series switches, multiple versions and models, and also names Zyxel access points, FWA7 devices and security routers as affected by vulnerabilities, without detailing which flaw applies to which. The available coverage does not say how many devices were compromised or whether a fixed firmware for CVE-2026-107441 is available. [1][3]

Timeline

  1. Binarly found that switches patched for CVE-2026-7273 stayed open to the exploit. [3]

  2. An advisory update noted open-source reporting of exploitation of CVE-2026-107441. [1]

  3. Zyxel published a security advisory covering GS1900 series switches. [1]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

If your office network uses Zyxel GS1900 switches, they may be exposed even if they were updated earlier. No confirmed fix for this flaw appears in the available coverage. [3][1]

What to do

  1. Ask your IT provider whether Zyxel GS1900 switches are in use and whether Zyxel's latest advisory applies. [1]
  2. Check that the switch management page is not reachable from the internet. [2]

Mid-size company

A small IT or security team

What to know

Zyxel's earlier June patch addressed a different bug, so patch status for CVE-2026-7273 does not show protection against CVE-2026-107441. [3]

What to do

  1. Inventory GS1900 series switches and compare them with the models and versions in Zyxel's advisory. [1]
  2. Watch Zyxel's advisory for fixed firmware and apply it when published. [1]

Large enterprise

A security operations team

What to know

Exploitation is reported in open sources, and the flaw allows command execution through crafted HTTP requests on network infrastructure. [1][2]

What to do

  1. Identify all Zyxel GS1900 switches and review web management exposure and access logs for unusual HTTP requests. [2]
  2. Track Zyxel's advisory and Binarly's findings for fixes and indicators of compromise. [3][1]

Sources

  1. [1]Canadian Centre for Cyber Security · Nov 4, 15:07 UTC
    Zyxel security advisory (AV26-1114) – Update 1context
  2. [2]SecurityWeek · Nov 5, 10:56 UTC
    Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Daycontext
  3. [3]Help Net Security · Nov 5, 12:06 UTC
    Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441)context