Zyxel GS1900 Vulnerability CVE-2026-107441: 996 Switches Hacked, the June Patch Fell Short, and the Firmware to Install

Attackers broke into 996 Zyxel GS1900 network switches in 48 countries this year and copied their configurations and hashed root passwords. If your office, shop or warehouse runs a GS1900 switch, even one you updated in June, it is still exposed: on Tuesday, November 3, 2026, Zyxel published new firmware for a second flaw, CVE-2026-107441, that the June update did not close, and it needs to go on this week.

What happened with the Zyxel GS1900 switches

The GS1900 is Zyxel's line of smart managed switches. These are the boxes in the network closet that connect desks, phones, cameras and Wi-Fi access points. Each one has a web page for management, and that web page is where the problem is.

Here is the timeline, taken from Zyxel and GreyNoise:

• Tuesday, June 16, 2026: Zyxel published an advisory for CVE-2026-7273, a stack-based buffer overflow in the CGI program of the GS1900 firmware, with fixed firmware ending in ".2" for ten models.
• On or about Monday, August 17: GreyNoise says an attacker took configurations, networking information and hashed root-level credentials from 996 GS1900 switches in 48 countries.
• Monday, September 21: GreyNoise published its report and linked the activity to CVE-2026-7273. CISA added that CVE to its Known Exploited Vulnerabilities catalog the same day.
• Tuesday, November 3: Zyxel published a new advisory for CVE-2026-107441, an out-of-bounds write in the same CGI program, and credited researchers at Binarly with the report. The fix is firmware ending in ".3".

The important detail is in Zyxel's own table. The versions it lists as vulnerable to the new flaw include the ".2" releases that fixed the June bug. So a switch someone patched carefully in the summer is still vulnerable today. We wrote about this pattern in Updated Is Not the Same as Patched.

What is confirmed and what is not

Confirmed by Zyxel: an attacker on the local network who has not logged in could send a crafted HTTP request to the switch and possibly run operating system commands. Ten GS1900 models are affected, and fixed firmware is out for all ten.

Confirmed by GreyNoise's report: 996 switches in 48 countries were hit. The most affected countries were Italy (133), the United States (129), Taiwan (123), France (90) and South Korea (69). 564 of those switches were still using factory default credentials. The attacker's script took configurations, network details and hashed root credentials.

Claimed, not confirmed: Binarly reports that the exploit it recovered from attacker infrastructure still worked on the June-patched firmware. If so, the break-ins may have used this newer flaw, not only the June one. GreyNoise calls the attacker a suspected Chinese speaker because of Chinese-language comments in its tools. That is an assessment, not a confirmed attribution.

Not known: how the attacker reached so many switches when Zyxel describes a LAN-based attacker; whether any settings were changed or anything was left behind; and whether CVE-2026-107441 itself has been exploited, because Zyxel's advisory does not say.

Zyxel GS1900 affected models and fixed firmware

Zyxel says products not in its table are not affected. It also says it only patches models still inside their support period. If you have an older GS1900 that is not listed, ask Zyxel about it before you assume it is safe.

How to check your Zyxel switch firmware version

Log in to the switch's web management page and find the firmware version on the status or system information screen. Compare the code in brackets with the table. If the number after the dot is .2 or lower, for example AAHL.2, the switch needs updating. A .3 release is fixed.

What to do this week

1. Find every GS1900. Check closets, branch offices and any switch a contractor installed. Write down model and firmware for each.
2. Install the .3 firmware. Download it only from Zyxel's official support site, and plan a short outage while the switch reboots.
3. Change the admin password. This matters most if it is still the factory default, which was true for more than half of the hacked switches. If that password is used anywhere else, change it there too.
4. Lock down the management page. Put it on a separate management network. Do not let guest Wi-Fi reach it, and never forward it to the internet.
5. Compare the configuration with a known-good backup. Look for admin accounts you do not recognise, VLAN or port changes, and new logging or monitoring destinations.
6. Rotate secrets stored in the config. That means SNMP community strings, RADIUS keys and any other shared secrets, because the stolen files may contain them.
7. Replace anything Zyxel no longer patches. A switch with no updates will never be fixed.

Why a hacked switch matters for a company network

Every device in the building sends its traffic through a switch. A stolen switch configuration shows an attacker your VLANs, addresses and management settings, so it works as a map of your network. Taking over network gear is a known way to get inside quietly, as covered in our post on Volt Typhoon's hijacked router network. These are also the devices most likely to be skipped when updates go out, because once installed nobody looks at them. If you are not sure who owns that job at your company, read Who Is Patching the Software That Runs Your Business?

Zyxel GS1900 vulnerability questions people are asking

Is the Zyxel GS1900 being actively exploited?

Yes. GreyNoise documented 996 compromised switches, and CISA lists CVE-2026-7273 as known exploited. Zyxel has not said whether CVE-2026-107441 has been exploited, though Binarly reports that the attackers' exploit works against June-patched firmware.

I patched my Zyxel switch in June. Am I safe?

No. Zyxel lists the June ".2" firmware as vulnerable to CVE-2026-107441. You need the ".3" release.

What is CVE-2026-107441?

An out-of-bounds write in the GS1900 firmware's CGI program. According to Zyxel, an attacker who has not logged in could use it to run operating system commands on the switch.

Which firmware version fixes the Zyxel GS1900 flaw?

2.90 with a .3 model code, such as 2.90(AAHL.3)C0 for the GS1900-24. Check the table for your model.

Does this affect other Zyxel switches or firewalls?

Zyxel's advisory lists only the ten GS1900 models and says products not listed are not affected.

Can attackers reach my switch from the internet?

Zyxel describes the attacker as LAN-based, but a management page reachable from the internet, a guest network or a hacked laptop puts far more people on that LAN. Keep it on a separate management network.

The bigger lesson

A patch is a promise until someone checks the version on the device, so if you want your network gear checked and kept current, see our security hardening service or request a quote.

Get security alerts like this by email, with our free checklist, at our security alerts page.

Sources: Zyxel advisory for CVE-2026-107441; Zyxel advisory for CVE-2026-7273; GreyNoise report; Binarly advisory BRLY-2026-057.