Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it ยท updates https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441 Zyxel patched CVE-2026-107441, an out-of-bounds write in the CGI web management program of ten GS1900 switch models that lets an unauthenticated attacker who can reach the web interface run OS commands with a crafted HTTP request. GreyNoise saw a threat actor it tracks as Kapibala compromise 996 GS1900 switches in 48 countries from around August 17, stealing configurations, hashed root credentials and network information. That activity was first blamed on CVE-2026-7273 (patched in June, added to CISA KEV on Sep 21), but Binarly found the recovered exploit still worked on all ten firmware releases that fixed CVE-2026-7273, so switches with only that update stayed exposed. Zyxel shipped fixed 2.90(...3)C0 firmware on Oct 22 and published its advisory on Nov 3. Install the 2.90(...3)C0 build for your model, keep the web management interface on a trusted management VLAN, and check switches whose web UI was reachable from other networks for signs of compromise. en Tue, 03 Nov 2026 00:00:00 GMT Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Zyxel publishes its security advisory for CVE-2026-107441 covering ten GS1900 models; NVD publishes the CVE (CVSS 8.8). https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441 https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-11-03-faddcb3b Tue, 03 Nov 2026 00:00:00 GMT high <p><a href="https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026">Source</a></p> Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Zyxel releases 2.90(...3)C0 firmware that limits parameter sizes and validates the parameter count, assigning the new flaw CVE-2026-107441. https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441 https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-10-22-38a80e33 Thu, 22 Oct 2026 00:00:00 GMT high <p><a href="https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/">Source</a></p> Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Binarly confirms the recovered exploit still works against all ten firmware releases patched for CVE-2026-7273, and reports it to Zyxel on Sep 29. https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441 https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-09-28-e78d54f4 Mon, 28 Sep 2026 00:00:00 GMT high <p><a href="https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/">Source</a></p> Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: GreyNoise discloses the campaign and attributes it to CVE-2026-7273; CISA adds CVE-2026-7273 to its Known Exploited Vulnerabilities catalog the same day. https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441 https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-09-21-96b82e6f Mon, 21 Sep 2026 00:00:00 GMT high <p><a href="https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/">Source</a></p> Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Around this date the Kapibala actor exploits 996 GS1900 switches in 48 countries and exfiltrates configurations, hashed root credentials and network information, per GreyNoise. https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441 https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-08-17-45d3e7b5 Mon, 17 Aug 2026 00:00:00 GMT high <p><a href="https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation">Source</a></p> Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Zyxel releases firmware fixing CVE-2026-7273, a pre-authentication buffer overflow in the same GS1900 switches. https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441 https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-06-16-a2e861d2 Tue, 16 Jun 2026 00:00:00 GMT high <p><a href="https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/">Source</a></p>