Your network switch is the quiet box in the corner of the office, the server room, or the wiring closet. It hums along for years, nobody thinks about it, and it just works. That is exactly why it makes such a good target — and why the Zyxel GS1900 zero-day should worry anyone who owns one of these switches, or whose office, school, or small business depends on one.
In early November 2026, Zyxel confirmed a serious flaw in its popular GS1900 series of managed switches, tracked as CVE-2026-107441. The flaw lets an attacker with network access run commands on the switch as root, without needing a password. Researchers say attackers had been exploiting it since August, compromising around 996 switches in 48 countries — including the United States — before anyone realised the patch meant to stop the attacks was fixing the wrong bug.
What happened: 996 switches in 48 countries
Zyxel published its security advisory on November 3, 2026, for a flaw in the web management interface of its GS1900 switches. CVE-2026-107441 is an out-of-bounds write in the switch’s CGI program — the software behind the web page administrators use to configure the device. An unauthenticated attacker who can reach the switch over the network can send a crafted web request and get it to run operating system commands of their choosing, with root privileges.
A switch sits at the centre of a local network, and an attacker who controls it can steal its configuration, harvest stored credentials, watch network traffic, and use it as a foothold to reach other systems. Switches are rarely monitored the way laptops and servers are, so an intrusion can sit there unnoticed for months.
According to threat intelligence firm GreyNoise, a suspected Chinese-speaking actor tracked as Kapibala — linked to a campaign researchers call Red Heron — had been exploiting the flaw since around August 17, 2026. GreyNoise counted about 996 compromised GS1900 switches across 48 countries, with Italy, the United States, and Taiwan hit hardest. The attackers stole device configurations, network details, and hashed root passwords, and installed persistent malware, including a backdoor known as JITTERLY and a rootkit called SIXZUT. More than half of the compromised switches — 564 of them — were still running factory-default credentials.
Canada’s Centre for Cyber Security issued an alert (AV26-1114, updated November 4) saying the flaw is being exploited in the wild.
The patch that did not patch
The most unsettling part of this story is not the flaw itself. It is that defenders thought it was already fixed.
On June 16, 2026, Zyxel released a firmware update — Patch 2 — that fixed a different flaw in the same switches, CVE-2026-7273, a pre-authentication buffer overflow in the same CGI program. When attacks on GS1900 switches were spotted in the weeks that followed, GreyNoise attributed them to CVE-2026-7273, and on September 21 the US Cybersecurity and Infrastructure Security Agency (CISA) added that flaw to its Known Exploited Vulnerabilities catalogue.
That model was wrong. Firmware security firm Binarly tested a recovered exploit against all ten firmware releases carrying the June fix and found, on September 28, that it still worked on every one. The June patch had closed a real bug — but the attacks were using a different one, hiding in the same code. Binarly reported the new flaw to Zyxel on September 29. Zyxel confirmed it on October 11, shipped the real fix as Patch 3 firmware on October 22, and published the advisory on November 3.
A detailed technical analysis of CVE-2026-107441 lays out how Binarly proved the June patch was a bypass, and the timeline of the Zyxel GS1900 zero-day shows how the misdiagnosis unfolded from June to November. As of November 5, the real exploited flaw still had not been added to CISA’s Known Exploited Vulnerabilities catalogue — only the older, wrongly blamed flaw was on it.
Which switches are affected
The flaw affects ten models in Zyxel’s GS1900 series, all running firmware version 2.90(….2)C0 and earlier — which includes the June Patch 2 releases. The affected models are the GS1900-8 and GS1900-8HP, the GS1900-10HP, the GS1900-16, the GS1900-24, GS1900-24E, GS1900-24EP and GS1900-24HPv2, and the GS1900-48 and GS1900-48HPv2.
The fix is firmware version 2.90(….3)C0 — Patch 3 — built separately for each model. If your switch is running any “.2” build or earlier, it is vulnerable, even if you installed the June update. Only the “.3” builds close this hole.
How the attack worked
Every GS1900 switch has a web page for administration, served by small programs including one called dispatcher.cgi. The new flaw is an out-of-bounds write: when the switch handles certain web requests, it copies data into a space in memory that is too small for it, spilling into neighbouring memory. An attacker can craft a request that uses that spill to take control and run commands as root.
No login is needed, and no user has to click anything. All the attacker needs is network access to the switch’s management interface — from the internet, if the interface is exposed, or from inside the network via a compromised computer or guest device. Once in, the attackers copied the switch’s configuration and hashed root password, then installed persistent malware so they could return even after a reboot. Zyxel rates the flaw 8.8 out of 10; Binarly rates it 9.8.
What to do right now
If you own, manage, or are responsible for a Zyxel GS1900 switch — at work, at a school, or in a home lab — run through this checklist today.
1. Check your firmware version
Log in to the switch’s web management page and check the firmware version. If it is 2.90(….2)C0 or anything earlier, the switch is vulnerable. You need the Patch 3 release, 2.90(….3)C0, built for your exact model — download it from Zyxel’s support site, not from a forum or an email link.
2. Install Patch 3
Apply the update during a maintenance window, because the switch will reboot. Do not assume the June update protected you — that is precisely the assumption that left hundreds of switches exposed. After the update, confirm the new version number is actually displayed. Verify, don’t assume.
3. Take the management interface off the internet
The management web page should never be reachable from the public internet. Restrict it to a management network or a VPN, and block access from anywhere else at the firewall. This single step would have stopped most of these attacks.
4. Change every default password
If any switch is still using its factory-default admin or root password, change it immediately, using a long, unique password stored in a password manager. The fact that 564 of the compromised switches still had default credentials is the most avoidable part of this whole incident. Stolen credentials and phishing go together, so remind your users how to spot a phishing email too.
5. Rotate credentials and look for tampering
If your switch was reachable from the internet, or ran the vulnerable firmware while exposed, assume its stored credentials are compromised. Change the root and admin passwords and rotate any credentials the switch stored. Then check for unfamiliar administrator accounts, unexpected configuration changes, or unusual traffic. If you find anything odd, treat the switch as compromised: back up the configuration, factory-reset the device, reinstall the latest firmware from scratch, and rebuild the configuration rather than restoring a possibly tampered backup.
Why this matters beyond Zyxel
It is tempting to file this under “someone else’s problem” if you do not own a Zyxel switch. That would be a mistake. Attackers increasingly target the quiet infrastructure — switches, routers, firewalls, VPN appliances — because those devices are powerful, poorly monitored, and rarely patched. In the same week this story broke, researchers were also warning about a flaw in the APT package manager used by Debian and Ubuntu Linux, a suspected Russian APT29 campaign against mobile users, and a confirmed breach at certificate authority DigiCert.
Finally, it is a reminder that the devices in our homes and small offices need the same care as the big systems. A small business with one GS1900 switch in a closet is just as exposed as a large enterprise — and far less likely to have someone watching for it. The same habit applies to every device on your network, including the laptop on your desk: if it feels sluggish, here is how to speed up a slow laptop, and check that its software is fully updated too.
What happens next
Zyxel has done the right thing since Binarly’s report: it confirmed the flaw, shipped the fix, and published a clear advisory. The outstanding question is how many vulnerable switches are still out there — with roughly a thousand already compromised, the real number is almost certainly far higher.
If you have a GS1900, update it to Patch 3, take its management page off the internet, change the default passwords, and check for tampering. Do it today — the attackers had a three-month head start.