Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Zyxel patches GS1900 zero-day used on nearly 1,000 switches

8 sources · 8 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Zyxel has patched CVE-2026-107441 after attackers compromised 996 GS1900 switches already fixed for a different flaw.

Attackers compromised 996 Zyxel GS1900 switches in 48 countries starting in August 2026, using an unauthenticated out-of-bounds write to run OS commands and steal configurations and hashed credentials. The activity was first tied to CVE-2026-7273, patched in June, but Binarly found the exploit still worked and identified separate CVE-2026-107441. BleepingComputer attributes the campaign to a suspected Chinese-speaking actor, Kapibala, and links it to Red Heron and the JITTERLY and SIXZUT backdoors. Zyxel confirmed the flaw and shipped firmware limiting HTTP parameter sizes; BleepingComputer, CSO Online and Help Net Security say October 22, while The Hacker News and SecurityWeek say October 23. Zyxel rates it 8.8; The Hacker News and Infosecurity Magazine say Binarly rates it 9.8.

Key facts
  • 996 GS1900 switches in 48 countries were compromised.
  • CVE-2026-107441 survived the June fix for CVE-2026-7273.
  • All 10 GS1900 models running Patch 2 firmware are affected.
  • Fixed builds are 2.90 Patch 3, including 2.90(AAHH.3)C0 on the GS1900-8.
  • CISA added CVE-2026-7273 to the KEV catalog on September 21.
  • Zyxel published an advisory on November 3; no workaround is described.
Analyze CVE-2026-7273 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Jun 16, 2026Zyxel patched CVE-2026-7273 in GS1900 firmware. · Infosecurity Magazine
  2. Sep 21, 2026CISA added CVE-2026-7273 to the KEV catalog. · Infosecurity Magazine
  3. Sep 29, 2026Binarly reported the separate exploit to Zyxel. · SecurityWeek
  4. Oct 11, 2026Zyxel confirmed CVE-2026-107441. · BleepingComputer
  5. Oct 22, 2026Zyxel released firmware fixes for the new flaw. · BleepingComputer
  6. Nov 3, 2026Zyxel published an advisory for CVE-2026-107441. · Infosecurity Magazine

What each outlet adds

beyond the shared facts
  • BleepingComputerNames Kapibala, Red Heron, and JITTERLY and SIXZUT backdoors.
  • GBHackersDescribes GOT overwrite and ASLR brute-force exploit modes.
  • The Hacker NewsDates Patch 3 to October 23 and says no workaround.
  • SecurityWeekAlso dates the patch to October 23 and names malware variants.
  • Infosecurity MagazineGives June 16, KEV date, advisory date and model versions.
CVEs
CVE-2026-7273CVE-2026-107441
Vendors
ZyxelBinarlyGreyNoise
Products
GS1900GS1900 series switchesGS1900 series
Threat actors
Red HeronKapibala
Malware
JITTERLYSIXZUTJitterlySixzut
Organizations
BinarlyGreyNoiseCISA
Countries
48China

Coverage

oldest first · one row per article · UTC
  1. · 6d ago BleepingComputerFirst report

    Zyxel fixes zero-day exploited to hack nearly 1,000 network switches

    Zyxel patched CVE-2026-107441 after Kapibala exploited it to compromise 996 GS1900 switches and steal credentials; the flaw bypassed a prior patch for CVE-2026-7273.

  2. · 6d ago GBHackers

    Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability

    Attackers compromised nearly 1,000 Zyxel GS1900 switches via pre-authentication RCE before Zyxel patched the flaw.

  3. · 6d ago The Hacker News

    Zyxel GS1900 switches remain vulnerable to root command execution

    Zyxel GS1900 Patch 2 fails to block zero-day allowing unauthenticated root access; Patch 3 fixes CVE-2026-107441

  4. · 6d ago CSO Online

    Zyxel Patches Zero-Day Vulnerability in GS1900 Switches

    Zyxel released firmware updates for CVE-2026-107441 affecting GS1900 switches after it was exploited in 48 countries.

  5. · 6d ago SecurityWeek

    Zyxel GS1900 zero-day exploited in wild despite patch

    Attackers used CVE-2026-107441 to compromise nearly 1,000 Zyxel switches after it was misattributed to a patched flaw.

  6. · 6d ago SOCRadar

    Zyxel GS1900 Zero-Day Patch 3 Fixes Bypassed Bug

    Zyxel GS1900 zero-day has been addressed in Patch 3.

  7. · 6d ago Help Net Security

    Patched Zyxel GS1900 switches remain open to CVE-2026-107441 exploit

    Binarly discovered the CVE-2026-107441 exploit still works on firmware fixed for a different CVE.

  8. · 6d ago Infosecurity Magazine

    Zyxel GS1900 June patch missed flaw behind attacks on 996 switches

    Binarly says all 10 June firmware releases still allow unauthenticated root commands; Zyxel shipped a later fix.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-107441
Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0
8.8—
CVE-2026-7273
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
8.83%KEVPoC
KEV