Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Zyxel patches GS1900 zero-day used on 996 switches

10 sources · 10 articlesFirst reported Updated ()2
What's new

November 5: Infosecurity Magazine adds that Zyxel fixed CVE-2026-7273 on June 16, CISA listed that CVE on September 21, and Zyxel published its advisory on November 3 after October 22 firmware.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Zyxel has patched CVE-2026-107441 after it was used to compromise 996 GS1900 switches left exposed by the June CVE-2026-7273 fix.

Zyxel has released firmware for GS1900 switches that closes CVE-2026-107441, an unauthenticated out-of-bounds write used to run commands as root. GreyNoise reported that attackers compromised 996 switches in 48 countries from August 2026, stealing configurations and hashed credentials. BleepingComputer identifies the actor as Kapibala, a suspected Chinese-speaking group tied to the Red Heron campaign and backdoors JITTERLY and SIXZUT. The exploit bypassed June firmware for CVE-2026-7273. Binarly reported the distinct flaw on September 29; Zyxel confirmed it on October 11. Outlets disagree on the fix date—October 22 or October 23, per The Hacker News and SecurityWeek—and on severity, with Zyxel rating it 8.8 and Binarly 9.8. June builds remain affected until the new firmware is applied. Zyxel published its advisory on November 3.

Key facts
  • GreyNoise counted 996 switches in 48 countries; Italy, the United States, and Taiwan led.
  • Cyber Security News says 564 compromised switches still used factory default logins.
  • Affected builds include 2.90 Patch 2 and earlier; Patch 3 is the fix.
  • CISA added CVE-2026-7273 to the KEV catalog on September 21.
  • GBHackers describes GOT overwrite and ASLR brute-force exploit modes.
  • The Hacker News says no workaround is available for unpatched switches.
Analyze CVE-2026-7273 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Jun 16, 2026Zyxel released firmware fixing CVE-2026-7273 · Infosecurity Magazine
  2. Sep 21, 2026CISA added CVE-2026-7273 to the KEV catalog · Infosecurity Magazine
  3. Sep 29, 2026Binarly notified Zyxel of the separate flaw · SecurityWeek
  4. Oct 11, 2026Zyxel confirmed CVE-2026-107441 · BleepingComputer
  5. Oct 22, 2026Zyxel released firmware closing the zero-day · Infosecurity Magazine
  6. Nov 3, 2026Zyxel published its security advisory · Infosecurity Magazine

What each outlet adds

beyond the shared facts
  • Infosecurity MagazineJune 16 fix date, September 21 KEV listing, and November 3 advisory
  • BleepingComputerNames Kapibala, October 11 confirmation, and linked backdoors
  • Cyber Security News564 factory-default logins; Italy, United States, and Taiwan led
  • GBHackersGOT overwrite and ASLR brute-force exploit modes
  • The Hacker NewsPlaces the fix on October 23 and notes no workaround
CVEs
CVE-2026-7273CVE-2026-107441
Vendors
ZyxelBinarlyGreyNoiseCanadian Centre for Cyber Security
Products
GS1900GS1900 switchesGS1900 series switchesGS1900 seriesAPsFWA7Security Routers
Threat actors
Red HeronKapibala
Malware
JITTERLYSIXZUTJitterlySixzut
Victims
GS1900 switches in 48 countries
Organizations
BinarlyGreyNoiseCISA
Countries
ItalyUnited StatesTaiwan48China

Coverage

oldest first · one row per article · UTC
  1. · 6d ago Canadian Centre for Cyber SecurityFirst report

    Zyxel GS1900 switches and APs hit by out-of-bounds write and buffer overflow

    Zyxel security advisory AV26-1114 reports out-of-bounds write in GS1900 series switches and buffer overflow in APs FWA7 Security Routers; users should apply updates.

  2. · 5d ago Cyber Security News

    Hackers Exploit Zyxel GS1900 Zero-Day in the Wild

    Patch for CVE-2026-7273 left switches vulnerable to new CVE-2026-107441 remote root command execution.

  3. · 4d ago BleepingComputer

    Zyxel fixes zero-day exploited to hack nearly 1,000 network switches

    Zyxel patched CVE-2026-107441 after Kapibala exploited it to compromise 996 GS1900 switches and steal credentials; the flaw bypassed a prior patch for CVE-2026-7273.

  4. · 4d ago GBHackers

    Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability

    Attackers compromised nearly 1,000 Zyxel GS1900 switches via pre-authentication RCE before Zyxel patched the flaw.

  5. · 4d ago The Hacker News

    Zyxel GS1900 switches remain vulnerable to root command execution

    Zyxel GS1900 Patch 2 fails to block zero-day allowing unauthenticated root access; Patch 3 fixes CVE-2026-107441

  6. · 4d ago CSO Online

    Zyxel Patches Zero-Day Vulnerability in GS1900 Switches

    Zyxel released firmware updates for CVE-2026-107441 affecting GS1900 switches after it was exploited in 48 countries.

  7. · 4d ago SecurityWeek

    Zyxel GS1900 zero-day exploited in wild despite patch

    Attackers used CVE-2026-107441 to compromise nearly 1,000 Zyxel switches after it was misattributed to a patched flaw.

  8. · 4d ago SOCRadar

    Zyxel GS1900 Zero-Day Patch 3 Fixes Bypassed Bug

    Zyxel GS1900 zero-day has been addressed in Patch 3.

  9. · 4d ago Help Net Security

    Patched Zyxel GS1900 switches remain open to CVE-2026-107441 exploit

    Binarly discovered the CVE-2026-107441 exploit still works on firmware fixed for a different CVE.

  10. · 4d ago Infosecurity Magazine

    Zyxel GS1900 June patch missed flaw behind attacks on 996 switches

    Binarly says all 10 June firmware releases still allow unauthenticated root commands; Zyxel shipped a later fix.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-107441
Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0
8.8—
CVE-2026-7273
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
8.83%KEVPoC
KEV