Zyxel Switches Hit by Zero Day Affecting Nearly 1,000 Devices

SecurityWeek reports that a recently patched vulnerability in Zyxel GS1900 series switches was exploited in the wild as a zero-day to compromise nearly 1,000 devices. The flaw, tracked as CVE-2026-107441, is an out-of-bounds write in the CGI component of the GS1900 firmware, with a CVSS score of 8.8. Zyxel says an unauthenticated attacker could trigger OS command execution through crafted HTTP requests. The affected models span 10 GS1900 switch variants, and Zyxel issued fixes on 23 October and published a security advisory on 3 November 2026.

Binarly’s analysis, published on 3 November 2026, disputes earlier attribution to CVE-2026-7273 and the Chinese threat group linked to Red Heron. Instead, Binarly states that attackers deployed variants of the Jitterly and Sixzut families but targeted a previously unknown vulnerability—the CVE now identified as CVE-2026-107441. Binarly notified Zyxel on 29 September, and Zyxel corroborated the new vulnerability two weeks later.

The firm notes that patches for CVE-2026-7273 remained ineffective against these campaigns, underscoring the difficulty of assessing vulnerability presence purely from advisories or version numbers. GreyNoise’ earlier September warning had linked the activity to CVE-2026-7273, but Binarly’s findings attribute the active exploitation to CVE-2026-107441.