Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day

Research firm Binarly has revealed that a wave of attacks on nearly 1,000 Zyxel GS1900 series switches, previously thought to stem from a known, already-patched flaw, actually relied on an unpatched zero-day bug. The real culprit is CVE-2026-107441, an out-of-bounds write vulnerability in the switch firmware's CGI component carrying a CVSS score of 8.8, which let unauthenticated attackers run OS commands through specially crafted HTTP requests across ten GS1900 models. GreyNoise had earlier attributed the August compromises to a Chinese group exploiting CVE-2026-7273, a separate Zyxel flaw fixed back in June, and CISA had even added that CVE to its KEV list — but Binarly found the attackers, who deployed Jitterly and Sixzut malware linked to the Red Heron actor, never actually targeted that bug. Zyxel confirmed the newly discovered flaw after Binarly's September 29 disclosure and shipped a fix on October 23, with an advisory following on November 3.