Zyxel fixes GS1900 flaw researchers tie to ~1,000 hacked switches

On November 3, 2026, Zyxel published a security advisory for CVE-2026-107441, an out-of-bounds write flaw in the CGI program of its GS1900 series switch firmware. Zyxel says the flaw “could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.” Zyxel rates it CVSS 3.1 8.8 (High). The fixed firmware is version 2.90 Patch 3; Zyxel’s Patch 3 release thread is dated October 23.

What happened

• June 16, 2026: Zyxel fixed an earlier GS1900 flaw, CVE-2026-7273.
• From about August 17: according to BleepingComputer, the security firm GreyNoise saw attackers compromise 996 GS1900 switches in 48 countries and collect device configurations, hashed root credentials and network information.
• September 21: GreyNoise blamed CVE-2026-7273 (per BleepingComputer), and CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) catalog.
• September 28: the firmware security firm Binarly found that the exploit still worked against all ten firmware releases that fixed CVE-2026-7273. It reported this to Zyxel on September 29 (per BleepingComputer).
• October 11: Zyxel confirmed a separate flaw and assigned CVE-2026-107441 (per BleepingComputer).
• October 22 (per BleepingComputer; Zyxel’s release thread is dated October 23): Zyxel released 2.90 Patch 3 firmware for the affected models. Its release notes list a fix for a “Pre-authentication out-of-bounds write vulnerability” (CVE-2026-107441).

In short: according to Binarly, June firmware does not stop the exploit. Only the October Patch 3 firmware fixes the flaw.

Who is exposed

Any business running one of these GS1900 models on the firmware below. Zyxel says on-market products not listed are unaffected.

Zyxel’s firmware release notes also list the GS1900-8HP Rev. B1, which uses the same 2.90(AAHI.3)C0 file.

Exploitation status

The exploitation reports come from researchers (GreyNoise and Binarly, as reported by BleepingComputer). Zyxel’s advisory does not mention exploitation. As of CISA’s KEV feed dated November 4, 2026 (UTC), CVE-2026-107441 is not in the KEV catalog. The earlier CVE-2026-7273 is.

What to do

1. Find your switches. Check the model and firmware version of every GS1900 on your network in the web management interface.
2. Update to the fixed firmware in the table above (2.90 Patch 3, the “.3)C0” release). Download it from Zyxel’s site for your exact model. A June update is not enough.
3. Know what was taken in the attacks. According to BleepingComputer, the attackers’ script collected device configurations, hashed root credentials and network information. Zyxel’s advisory gives no clean-up steps and lists no workaround.

Sources

• Zyxel: “Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches” (Nov 3, 2026) - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026
• Zyxel Community: “Switch GS1900 Series - V2.90 Patch 3 Firmware Release” - https://community.zyxel.com/en/discussion/34420/switch-gs1900-series-v2-90-patch-3-firmware-release
• NVD: CVE-2026-107441 - https://nvd.nist.gov/vuln/detail/CVE-2026-107441
• CISA Known Exploited Vulnerabilities catalog - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• BleepingComputer: “Zyxel fixes zero-day exploited to hack nearly 1,000 network switches” (Nov 4, 2026) - https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/

Last checked: Nov 5, 2026, 2:58 p.m. Manila (UTC+8). Method: We read Zyxel’s Nov 3 advisory, Zyxel’s 2.90 Patch 3 release thread, NVD’s record for CVE-2026-107441, CISA’s KEV catalog and BleepingComputer’s Nov 4 report. Models and firmware versions are quoted from Zyxel; exploitation details come from researchers as reported by BleepingComputer. The thumbnail is an original OneSignalDesk card. No affiliate links. How we work.

Updates

• Nov 5, 2026, 1:09 p.m. Manila: First published.