Which switches are affected?

Ten GS1900 models are affected. Firmware through the 2.90 Patch 2 builds is open. The fix is the 2.90 Patch 3 build for each model.

Is the flaw in the CISA exploited list?

No. The new flaw was not in the CISA Known Exploited Vulnerabilities catalog as of November 4, 2026. The older June flaw was added on September 21, 2026.

Zyxel scores it 8.8. Binarly scores it 9.8. Binarly says the attacker gains root command execution. Zyxel says the attacker is local. Treat the higher score as the planning number.

ResourcesBlog

Zyxel GS1900 Zero-Day Hit Nearly 1,000 Switches After a Patch Missed It

Zyxel patched a GS1900 zero-day on October 22, 2026. Attackers had already used it to take over 996 switches. The June fix did not stop it.

Leonard EserePublished 2026-11-05Reading time 5 min

Filed underZyxel GS1900 zero-day flaw remediation evidence

Zyxel GS1900 Zero-Day Hit Nearly 1,000 Switches After a Patch Missed It

Summary

Zyxel published the advisory on November 3, 2026.
The flaw is an out-of-bounds write in the switch web interface.
Attackers took over 996 switches across 48 countries.
The June firmware fix did not stop the exploit.

What Zyxel published on November 3

Zyxel published a security advisory on November 3, 2026. The flaw is CVE-2026-107441. It is an out-of-bounds write in the Common Gateway Interface (CGI) program of GS1900 switch firmware. An unauthenticated attacker on the local network can send a crafted Hypertext Transfer Protocol (HTTP) request. The request can let the attacker run operating system commands on the switch. Zyxel lists ten affected GS1900 models. Firmware through the 2.90 Patch 2 builds is open to the flaw. The fix is the 2.90 Patch 3 build for each model. Zyxel released the fix on October 22, 2026.

The score split to plan around

Zyxel scores the flaw 8.8 under the Common Vulnerability Scoring System (CVSS). Binarly scores it 9.8 under the same scale. The split comes from different views of the attack path. Zyxel calls the attacker local to the network. Binarly says the flaw works over normal HTTP from any network that can reach the switch. Binarly also says the attacker gains root command execution. Root command execution means full control of the switch. Plan around the 9.8 score and the wider reach. A score dispute is not a reason to wait.

How attackers used it before the fix

GreyNoise observed attacks starting around August 17, 2026. A suspected Chinese-speaking actor it tracks as Kapibala ran the campaign. The actor compromised 996 switches across 48 countries. The attackers stole switch settings, hashed root credentials, and network details. The campaign first looked like exploitation of an older flaw. That older flaw is CVE-2026-7273. Zyxel patched it on June 16, 2026. The Cybersecurity and Infrastructure Security Agency (CISA) added the older flaw to its exploited list on September 21, 2026. That list is the Known Exploited Vulnerabilities (KEV) catalog. Binarly later found the real exploit in attacker infrastructure. It tested all ten June firmware builds on September 28, 2026. The exploit still worked on every one. Binarly told Zyxel on September 29, 2026. Zyxel confirmed the new flaw on October 11, 2026. Zyxel shipped the fix on October 22, 2026. The advisory followed on November 3, 2026. No source says the 996 switches ran the June firmware. Binarly showed the exploit still worked on the June builds. That is enough to treat every June build as open.

What to do now

Inventory every GS1900 switch, including closets and branch sites. Compare running firmware against the November 3 advisory. Install the 2.90 Patch 3 build for each model. Remove web management from internet reach where it is exposed. Rotate credentials that lived on any affected switch. Check logs for odd HTTP requests to the switch web interface.

The governance lesson

A patch can close the named flaw and still leave the hole open. That is what happened here. The June fix addressed one flaw. The exploit used a second flaw in the same code. Teams that checked a box after June stayed exposed until October. Evidence must prove the fix works, not just that a patch shipped. Record the firmware version on each switch. Record the date you installed it. Record a test that shows the exploit path is closed. That record turns a patch ticket into proof.

Sources

Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches, November 3, 2026. https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026
CVE-2026-107441 record, CVE Program. Zyxel scores it 8.8.
CVE-2026-7273 record, CVE Program.
BleepingComputer coverage, November 4, 2026. https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/
The Hacker News coverage, November 4, 2026, reporting Binarly research. http://thehackernews.com/2026/11/zyxel-gs1900-patch-fails-to-block-zero.html
CISA Known Exploited Vulnerabilities catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog. CVE-2026-107441 not listed as of November 4, 2026.
Original diagram by PolicyCortex.

Next step

Check every GS1900 switch against the November 3 advisory, then install the Patch 3 firmware.

Questions on this record

Which switches are affected?: Ten GS1900 models are affected. Firmware through the 2.90 Patch 2 builds is open. The fix is the 2.90 Patch 3 build for each model.
Does the June patch protect a switch?: No. Binarly tested all ten June builds on September 28, 2026. The exploit still worked on each one. Install the October 22 firmware.
Is the flaw in the CISA exploited list?: No. The new flaw was not in the CISA Known Exploited Vulnerabilities catalog as of November 4, 2026. The older June flaw was added on September 21, 2026.
How bad is the flaw?: Zyxel scores it 8.8. Binarly scores it 9.8. Binarly says the attacker gains root command execution. Zyxel says the attacker is local. Treat the higher score as the planning number.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state: Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change: Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency: Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture: Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.