Zyxel GS1900: the June patch did not stop the exploit

If your team closed a ticket for Zyxel GS1900 switches after the June patch, reopen it. Zyxel published an advisory on November 3, 2026 for a second flaw in the same switches, CVE-2026-107441, and researchers at Binarly found that the exploit attackers used against nearly 1,000 of these switches still worked on firmware that carried the June fix. The real fix is the 2.90 Patch 3 firmware, which Zyxel posted on October 22 and October 23.

This is a small-office story. The GS1900 is an inexpensive managed switch that tends to sit in branch closets and under desks, which is exactly where nobody checks firmware twice. It is also a clean example of a lesson that applies to any risk register: a patch installed is not the same as a risk closed.

What happened, in order

• June 16, 2026. Zyxel released updates for CVE-2026-7273, a pre-authentication stack-based buffer overflow in the GS1900 CGI program. Fixed builds were 2.90 Patch 2, written 2.90(XXXX.2)C0.
• From about August 17. GreyNoise observed a suspected Chinese-speaking actor it tracks as Kapibala exploiting GS1900 switches. It counted 996 compromised devices in 48 countries. The attackers ran a script that collected device configurations, hashed root credentials and network information. GreyNoise linked the actor to the Red Heron campaign that Acronis had reported earlier.
• September 21. GreyNoise disclosed the campaign and attributed it to CVE-2026-7273. CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog the same day, with a federal due date of September 24.
• September 28. Binarly, investigating Red Heron infrastructure, found an exposed archive holding an obfuscated Python exploit for the switches. It confirmed the exploit still achieved unauthenticated command execution on all ten firmware releases that had been patched for CVE-2026-7273. The exploit checked for those patched versions specifically.
• September 29 to October 11. Binarly reported the finding to Zyxel, which confirmed a new vulnerability and assigned CVE-2026-107441.
• October 22. Zyxel released 2.90 Patch 3 firmware, which limits parameter sizes and validates the parameter count before copying data into memory.
• November 3. Zyxel published its advisory. Canada’s Cyber Centre issued alert AV26-1114 the same day and updated it on November 4 to note open-source reporting that CVE-2026-107441 is exploited in the wild.

It is still unclear whether the exploit was written to bypass the June fix or whether it used a related bug the June fix never covered. For an owner, the answer is the same either way.

Which switches, which firmware

Zyxel describes the flaw as an out-of-bounds write in the CGI program that could let a LAN-based, unauthenticated attacker execute operating system commands with a crafted HTTP request. Its advisory lists ten models:

Swipe the table sideways to see every column.

The pattern is simple: a “.2” build is the June fix and is still vulnerable; you want the “.3” build. Zyxel says on-market products not in the table are unaffected and that it patched models still within their vulnerability support period.

Where the catalog stands

As of CISA’s catalog version 2026.11.06, released November 6, CVE-2026-7273 is listed and CVE-2026-107441 is not. That matters for teams that drive patching from the KEV list. The catalog entry you already handled points at the June fix, and the June fix did not stop the exploit. Do not wait for a second KEV entry to act on this one.

What it means for CFOs and CISOs

• “Patched” was the wrong closing condition. A ticket that closed when the June firmware was installed recorded the wrong control. The control that matters is “not exploitable by the known exploit,” and the only evidence for that is now the Patch 3 build number.
• Credentials may already be gone. The attackers took configurations and hashed root credentials. If a switch was exposed during the campaign, assume anything in its config, including SNMP strings, RADIUS or TACACS secrets and reused admin passwords, needs rotating.
• Cheap devices carry real exposure. A switch that cost a few hundred dollars can hold the same secrets as the firewall next to it. Asset lists that skip unmanaged-looking network gear are where this kind of miss starts.
• Vendor advisories lag exploitation. Exploitation began around mid-August; the advisory for the real bug arrived November 3. Budget the response time you need on the assumption that the advisory is late, not early.

What to do this week

1. Find every GS1900. Check your asset list, then the switch list in your network management tool, then branch and home-office closets. Note model and firmware build for each.
2. Upgrade to the “.3” build for that model from the table above. Confirm the version on the device after reboot, not just in the change ticket.
3. Take the web interface off untrusted networks. The flaw is in the web management CGI. Limit management access to a dedicated VLAN or admin hosts.
4. Rotate secrets. Change the admin password and any shared secrets stored in the switch configuration. Store the new ones somewhere shared and audited rather than a spreadsheet.
5. Look for signs of compromise. Check for unknown accounts, unexpected configuration changes and outbound connections from switch management addresses since mid-August.
6. Reopen the June ticket and close it again with the Patch 3 build number and the date you verified it.

For step 4, a business password manager with shared vaults and an access log fits the job. We compared four in our password manager guide; one option is NordPass Business. Affiliate link: we may earn a commission at no cost to you.

If you track exceptions, log any switch you cannot upgrade this week in the free risk exception register with an owner and an expiry date. The Renewal & Risk Operator Pack ($29) includes a spreadsheet version of that register alongside a renewal scorecard.

What to watch next

• A KEV listing for CVE-2026-107441. If CISA adds it, the due date will be short. We will update this page with the date.
• Further Binarly or GreyNoise detail. Indicators of compromise for the newer exploit would make step 5 more concrete.
• Other Zyxel advisories. The Cyber Centre alert also covers a separate buffer overflow in certain Zyxel access points, FWA7 and security routers. If you run those, read Zyxel’s advisory index.
• The general lesson. Binarly’s researchers said advisories and version numbers “cannot be blindly trusted.” For your own register, close high-risk items on evidence of the fixed state, not on a change ticket.

Sources

• Zyxel, “Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches,” November 3, 2026, checked November 7, 2026
• Zyxel Community, “Switch GS1900 Series V2.90 Patch 3 Firmware Release,” October 23, 2026, edited November 3
• Zyxel advisory for CVE-2026-7273, June 16, 2026
• CISA Known Exploited Vulnerabilities catalog, version 2026.11.06, checked November 7, 2026
• Canadian Centre for Cyber Security, AV26-1114, November 3, updated November 4, 2026
• Help Net Security, “Patched Zyxel GS1900 switches remained open to in-the-wild exploit,” November 5, 2026
• BleepingComputer, “Zyxel fixes zero-day exploited to hack nearly 1,000 network switches,” November 4, 2026

Related: Next week’s patch calendar and all security briefings.