Zyxel fixes zero-day exploited to hack nearly 1,000 network switches

Zyxel has issued firmware fixes for a previously unknown vulnerability in its GS1900 switch lineup that attackers used to break into roughly 1,000 devices across dozens of countries, stealing config files and login credentials. Tracked as CVE-2026-107441, the bug is an out-of-bounds write in the web admin panel that lets an attacker without any credentials send crafted HTTP requests to run arbitrary OS commands. Security firm Binarly traced the real-world attacks, initially blamed on the earlier CVE-2026-7273 flaw patched in June and added to CISA's exploited-vulnerabilities list, and found the exploit actually bypassed those June fixes by corrupting a parameter counter, working against all ten patched firmware builds. Zyxel confirmed the new flaw on October 11 and shipped corrected firmware on October 22, so owners of the ten impacted GS1900 models should update immediately to block this attack path.