Zyxel advisory published November 3, 2026; fixes released October 22, 2026; Binarly analysis reported November 5, 2026
The Patch Did Not Patch It: Zyxel GS1900 Attacks Used a Separate Zero-Day, CVE-2026-107441
The exploit that hit Zyxel GS1900 switches in the wild was not aimed at the flaw Zyxel patched in June. Binarly recovered the exploit, tested it against firmware carrying the June fix for CVE-2026-7273, and found it still worked, because it targets a separate out-of-bounds write in the switches CGI program, now tracked as CVE-2026-107441. The root cause is a copy that runs before its count check: an oversized request value can corrupt the counter that guards the request parameter store, and from there an attacker can hijack function pointers. Zyxel describes the flaw as allowing a LAN-based, unauthenticated attacker to execute operating system commands through crafted HTTP requests, and scores it 8.8; Binarly rates it 9.8 and describes remote root command execution. Both accounts agree on the operational facts that matter: Binarly confirmed on September 28 that all ten fixed firmware releases for the earlier flaw remained exploitable, Zyxel confirmed the new flaw on October 11, shipped fixed .3 firmware on October 22, and published its advisory on November 3. GreyNoise had reported 996 compromised switches across 48 countries from around August 17, with configurations and hashed root credentials stolen, under the earlier CVE number. Binarly is explicit that its analysis does not establish how many of those 996 devices fell to the newer bug, so the victim count belongs to the campaign, not yet to this CVE. CISA added the earlier CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on September 21.
Executives
A switch fleet can be fully patched on paper and fully exposed in fact. Here the June patch was real, the version numbers moved, and the attack kept working because the exploit used a different flaw in the same program. The lesson for any estate of network devices is that patch status is a claim to verify, not a state to assume: ask how patch effectiveness is confirmed for edge and network equipment, and whether anyone tests that a fix actually closes the exploited path before the item is closed.
CIO / CISO
Reopen any GS1900 closure tied to CVE-2026-7273. The action is the .3 firmware release for each of the ten models, not the June .2 release, and closure should include evidence from the device itself. Any switch that was reachable during the August campaign window also needs compromise review, because the campaign took configurations and hashed root credentials: rotate privileged credentials on affected devices and review configuration changes. Keep web management off the internet and on a dedicated administration network while the fleet is worked through.
Engineers
Upgrade every GS1900 to the .3 release for its model and verify the running firmware string on the device, not in the ticket. The same vulnerable parser also appears in the restore and upload CGI endpoints, so do not treat the dispatcher path as the only exposure. After upgrading, review configurations for changes nobody made, check for unexpected accounts, and rotate the root and administrative credentials on any switch that was exposed before the fix, since hashed credentials were part of what the campaign collected.
Everyone (non-IT)
Most home networks do not run this class of switch, and no home action follows from this story directly. The transferable habit is the verification step: after any security update on a router or similar device, check the version the device itself reports. An update that was scheduled, downloaded, or announced is not the same as an update that is running.