Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Zyxel GS1900 zero-day patched after nearly 1,000 switches were hit

7 sources · 7 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Zyxel has issued Patch 3 for CVE-2026-107441 after attackers compromised 996 GS1900 switches that a June fix left exposed.

Attackers exploited an unauthenticated remote command-execution flaw in Zyxel GS1900 switches, compromising 996 devices in 48 countries, according to GreyNoise. The activity was first linked to CVE-2026-7273, which Zyxel patched in June, but Binarly found the exploit still worked on those releases and reported a separate out-of-bounds write, CVE-2026-107441. Zyxel confirmed the new flaw and shipped Patch 3 for all 10 GS1900 models; outlets disagree on whether that firmware was released October 22 or October 23. Zyxel rates the flaw 8.8, while Binarly rates it 9.8. Zyxel published an advisory on November 3, and June firmware remains affected.

Key facts
  • CVE-2026-107441 allows unauthenticated OS command execution as root via the web interface.
  • 996 GS1900 switches in 48 countries were compromised, GreyNoise reported.
  • June firmware fixing CVE-2026-7273 left the new flaw in all 10 models.
  • On the GS1900-8, 2.90(AAHH.2)C0 and earlier is affected; 2.90(AAHH.3)C0 is fixed.
  • CISA added CVE-2026-7273 to the KEV catalog on September 21.
  • No workaround was reported for switches that have not installed Patch 3.
Analyze CVE-2026-7273 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Jun 16, 2026Zyxel patched CVE-2026-7273 and rated it 8.8. · Infosecurity Magazine
  2. Sep 21, 2026CISA added CVE-2026-7273 to the KEV catalog. · Infosecurity Magazine
  3. Sep 29, 2026Binarly notified Zyxel of the separate flaw. · SecurityWeek
  4. Oct 22, 2026Zyxel released firmware for CVE-2026-107441, some outlets say. · Infosecurity Magazine
  5. Nov 3, 2026Zyxel published an advisory on the new flaw. · Infosecurity Magazine

What each outlet adds

beyond the shared facts
  • The Hacker NewsGreyNoise tied August thefts to Red Heron; Patch 3 dated October 23.
  • SecurityWeekAttacks used Jitterly and Sixzut variants; patch dated October 23.
  • Help Net SecurityExploit found in malware tied to a Chinese-speaking actor.
  • Infosecurity MagazineJune 16 patch date, KEV listing, advisory date, and model versions.
  • GBHackersDescribes two exploit modes used against the switches.
CVEs
CVE-2026-7273CVE-2026-107441
Vendors
ZyxelBinarlyGreyNoise
Products
GS1900GS1900 series switchesGS1900 series
Threat actors
Red Heron
Malware
JitterlySixzut
Organizations
BinarlyGreyNoiseCISA
Countries
China

Coverage

oldest first · one row per article · UTC
  1. · 6d ago GBHackersFirst report

    Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability

    Attackers compromised nearly 1,000 Zyxel GS1900 switches via pre-authentication RCE before Zyxel patched the flaw.

  2. · 6d ago The Hacker News

    Zyxel GS1900 switches remain vulnerable to root command execution

    Zyxel GS1900 Patch 2 fails to block zero-day allowing unauthenticated root access; Patch 3 fixes CVE-2026-107441

  3. · 6d ago CSO Online

    Zyxel Patches Zero-Day Vulnerability in GS1900 Switches

    Zyxel released firmware updates for CVE-2026-107441 affecting GS1900 switches after it was exploited in 48 countries.

  4. · 6d ago SecurityWeek

    Zyxel GS1900 zero-day exploited in wild despite patch

    Attackers used CVE-2026-107441 to compromise nearly 1,000 Zyxel switches after it was misattributed to a patched flaw.

  5. · 6d ago SOCRadar

    Zyxel GS1900 Zero-Day Patch 3 Fixes Bypassed Bug

    Zyxel GS1900 zero-day has been addressed in Patch 3.

  6. · 6d ago Help Net Security

    Patched Zyxel GS1900 switches remain open to CVE-2026-107441 exploit

    Binarly discovered the CVE-2026-107441 exploit still works on firmware fixed for a different CVE.

  7. · 6d ago Infosecurity Magazine

    Zyxel GS1900 June patch missed flaw behind attacks on 996 switches

    Binarly says all 10 June firmware releases still allow unauthenticated root commands; Zyxel shipped a later fix.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-107441
Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0
8.8—
CVE-2026-7273
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
8.83%KEVPoC
KEV