Zyxel Patches Zero-Day in GS1900 Switches
A new flaw, CVE-2026-107441, lets unauthenticated attackers run operating system commands on ten GS1900 switch models.
Updated on Nov. 4, 2026 in Cybersecurity
Zyxel has patched a zero-day vulnerability, CVE-2026-107441, in its GS1900 series network switches, which allows unauthenticated attackers with network access to execute operating system commands. The flaw follows an earlier campaign by threat actor Kapibala that compromised 996 devices across 48 countries.
Why it matters
Network switches sit at the core of organizational infrastructure, so a flaw that permits unauthenticated command execution exposes every device on the affected network. The earlier exploitation campaign and the fact that a related exploit remained effective against patched firmware show how quickly such weaknesses can be turned into large-scale compromises.
The out-of-bounds write flaw in the GS1900 web management interface is triggered by specially crafted HTTP requests that corrupt a parameter counter before validation, bypassing earlier buffer overflow checks. The flaw affects ten GS1900 switch models, and the stub does not state how many of those devices remain unpatched.
The players
Zyxel
Zyxel is a networking equipment manufacturer whose GS1900 series switches are the subject of the flaw and the patches.
Kapibala
Kapibala is a threat actor suspected of China-based origin that exploited Zyxel GS1900 switches and compromised 996 devices across 48 countries.
GreyNoise
GreyNoise is a threat intelligence firm that observed the Kapibala exploitation campaign and disclosed it.
CISA
CISA is the U.S. Cybersecurity and Infrastructure Security Agency, which added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog.
Binarly
Binarly is a firmware security firm that confirmed the exploit remained effective against all patched CVE-2026-7273 firmware and reported its findings to Zyxel.
The details
Zyxel released security updates on October 22 and published a security advisory on November 3 addressing CVE-2026-107441. The vulnerability follows CVE-2026-7273, which Zyxel patched in June and which Kapibala exploited starting around August 17 before CISA added it to its Known Exploited Vulnerabilities catalog on September 21.
Timeline
June 16, 2026: Zyxel released patches for CVE-2026-7273.
August 17, 2026: GreyNoise began observing Kapibala exploitation of Zyxel switches.
September 21, 2026: CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog.
September 28, 2026: Binarly confirmed the exploit remained effective against all patched firmware for CVE-2026-7273.
October 11, 2026: Zyxel confirmed the new vulnerability, CVE-2026-107441.
The Tech Race
The new flaw follows CVE-2026-7273, which CISA added to its Known Exploited Vulnerabilities catalog on September 21 after Kapibala exploited it. Because the earlier patch was bypassed by a further vulnerability, the sequence shows vendor fixes being outpaced by attackers targeting the same switch line.
Anyone operating GS1900 switches should confirm their firmware includes the October security update and review network access to the switch's web management interface. Because the flaw requires only network access and no authentication, restricting management interface exposure reduces the risk of command execution on the device.
The takeaway
Network administrators should treat web management interfaces as sensitive attack surfaces and apply vendor patches promptly, since earlier fixes have been bypassed. Limiting management access to trusted networks is a practical step while patch status is verified across deployed devices.
Further reading
Explore more Cybersecurity coverage to see how network device flaws like this one fit into broader threat trends.
