# Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it · pwn.watch

> Zyxel patched CVE-2026-107441, an out-of-bounds write in the CGI web management program of ten GS1900 switch models that lets an unauthenticated attacker who can reach the web interface run OS commands with a crafted HTTP request. GreyNoise saw a threat actor it tracks as Kapibala compromise 996 GS1900 switches in 48 countries from around August 17, stealing configurations, hashed root credentials and network information. That activity was first blamed on CVE-2026-7273 (patched in June, added to CISA KEV on Sep 21), but Binarly found the recovered exploit still worked on all ten firmware releases that fixed CVE-2026-7273, so switches with only that update stayed exposed. Zyxel shipped fixed 2.90(...3)C0 firmware on Oct 22 and published its advisory on Nov 3. Install the 2.90(...3)C0 build for your model, keep the web management interface on a trusted management VLAN, and check switches whose web UI was reachable from other networks for signs of compromise.

Page: https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441 · generated 2026-11-04T23:11:58.039Z

## Status
- Severity: high · status: live · patch: patched
- Product: Zyxel GS1900 series switches (10 models) firmware 2.90(...2)C0 and earlier
- Started: 2026-08-17
- CVEs: CVE-2026-107441, CVE-2026-7273
- Affected: GS1900-8 2.90(AAHH.2)C0 and earlier; GS1900-8HP 2.90(AAHI.2)C0 and earlier; GS1900-10HP 2.90(AAZI.2)C0 and earlier; GS1900-16 2.90(AAHJ.2)C0 and earlier; GS1900-24 2.90(AAHL.2)C0 and earlier; GS1900-24E 2.90(AAHK.2)C0 and earlier; GS1900-24EP 2.90(ABTO.2)C0 and earlier; GS1900-24HPv2 2.90(ABTP.2)C0 and earlier; GS1900-48 2.90(AAHN.2)C0 and earlier; GS1900-48HPv2 2.90(ABTQ.2)C0 and earlier
- Fixed in: GS1900-8 2.90(AAHH.3)C0; GS1900-8HP 2.90(AAHI.3)C0; GS1900-10HP 2.90(AAZI.3)C0; GS1900-16 2.90(AAHJ.3)C0; GS1900-24 2.90(AAHL.3)C0; GS1900-24E 2.90(AAHK.3)C0; GS1900-24EP 2.90(ABTO.3)C0; GS1900-24HPv2 2.90(ABTP.3)C0; GS1900-48 2.90(AAHN.3)C0; GS1900-48HPv2 2.90(ABTQ.3)C0

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441/feed.xml
- JSON Feed: https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441.json
- This file: https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441/llms.txt

## Updates (newest first)
- 2026-11-03: Zyxel publishes its security advisory for CVE-2026-107441 covering ten GS1900 models; NVD publishes the CVE (CVSS 8.8). (https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026)
- 2026-10-22: Zyxel releases 2.90(...3)C0 firmware that limits parameter sizes and validates the parameter count, assigning the new flaw CVE-2026-107441. (https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/)
- 2026-09-28: Binarly confirms the recovered exploit still works against all ten firmware releases patched for CVE-2026-7273, and reports it to Zyxel on Sep 29. (https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/)
- 2026-09-21: GreyNoise discloses the campaign and attributes it to CVE-2026-7273; CISA adds CVE-2026-7273 to its Known Exploited Vulnerabilities catalog the same day. (https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/)
- 2026-08-17: Around this date the Kapibala actor exploits 996 GS1900 switches in 48 countries and exfiltrates configurations, hashed root credentials and network information, per GreyNoise. (https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation)
- 2026-06-16: Zyxel releases firmware fixing CVE-2026-7273, a pre-authentication buffer overflow in the same GS1900 switches. (https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/)

## Fix brief
# Security brief: Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it

Source: https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441 · status: live · severity: high · updated Nov 4, 2026, 21:17 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Zyxel patched CVE-2026-107441, an out-of-bounds write in the CGI web management program of ten GS1900 switch models that lets an unauthenticated attacker who can reach the web interface run OS commands with a crafted HTTP request. GreyNoise saw a threat actor it tracks as Kapibala compromise 996 GS1900 switches in 48 countries from around August 17, stealing configurations, hashed root credentials and network information. That activity was first blamed on CVE-2026-7273 (patched in June, added to CISA KEV on Sep 21), but Binarly found the recovered exploit still worked on all ten firmware releases that fixed CVE-2026-7273, so switches with only that update stayed exposed. Zyxel shipped fixed 2.90(...3)C0 firmware on Oct 22 and published its advisory on Nov 3. Install the 2.90(...3)C0 build for your model, keep the web management interface on a trusted management VLAN, and check switches whose web UI was reachable from other networks for signs of compromise.

Severity detail: Unauthenticated OS command execution (NVD CVSS 8.8, adjacent network); exploited in the wild against 996 switches before the fix

- Product: Zyxel GS1900 series switches (10 models) firmware 2.90(...2)C0 and earlier
- CVE / advisory ids: CVE-2026-107441, CVE-2026-7273

## Affected versions
- GS1900-8 2.90(AAHH.2)C0 and earlier
- GS1900-8HP 2.90(AAHI.2)C0 and earlier
- GS1900-10HP 2.90(AAZI.2)C0 and earlier
- GS1900-16 2.90(AAHJ.2)C0 and earlier
- GS1900-24 2.90(AAHL.2)C0 and earlier
- GS1900-24E 2.90(AAHK.2)C0 and earlier
- GS1900-24EP 2.90(ABTO.2)C0 and earlier
- GS1900-24HPv2 2.90(ABTP.2)C0 and earlier
- GS1900-48 2.90(AAHN.2)C0 and earlier
- GS1900-48HPv2 2.90(ABTQ.2)C0 and earlier

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- GS1900-8 2.90(AAHH.3)C0
- GS1900-8HP 2.90(AAHI.3)C0
- GS1900-10HP 2.90(AAZI.3)C0
- GS1900-16 2.90(AAHJ.3)C0
- GS1900-24 2.90(AAHL.3)C0
- GS1900-24E 2.90(AAHK.3)C0
- GS1900-24EP 2.90(ABTO.3)C0
- GS1900-24HPv2 2.90(ABTP.3)C0
- GS1900-48 2.90(AAHN.3)C0
- GS1900-48HPv2 2.90(ABTQ.3)C0

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
Zyxel's advisory itself does not mention exploitation; the in-the-wild link comes from GreyNoise and Binarly (BRLY-2026-057, not fetched). Re-check whether CISA adds CVE-2026-107441 to KEV.

## Latest updates
- Nov 3, 2026: Zyxel publishes its security advisory for CVE-2026-107441 covering ten GS1900 models; NVD publishes the CVE (CVSS 8.8).
- Oct 22, 2026: Zyxel releases 2.90(...3)C0 firmware that limits parameter sizes and validates the parameter count, assigning the new flaw CVE-2026-107441.
- Sep 28, 2026: Binarly confirms the recovered exploit still works against all ten firmware releases patched for CVE-2026-7273, and reports it to Zyxel on Sep 29.
- Sep 21, 2026: GreyNoise discloses the campaign and attributes it to CVE-2026-7273; CISA adds CVE-2026-7273 to its Known Exploited Vulnerabilities catalog the same day.
- Aug 17, 2026: Around this date the Kapibala actor exploits 996 GS1900 switches in 48 countries and exfiltrates configurations, hashed root credentials and network information, per GreyNoise.
- Jun 16, 2026: Zyxel releases firmware fixing CVE-2026-7273, a pre-authentication buffer overflow in the same GS1900 switches.

## Advisories
- [Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches](https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026) (Zyxel)
- [CVE-2026-107441 (GHSA-c73h-2jmc-4mfp)](https://github.com/advisories/GHSA-c73h-2jmc-4mfp) (GitHub Advisory Database)

## Write-ups & news
- [Zyxel fixes zero-day exploited to hack nearly 1,000 network switches](https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/)
- [Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation](https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation)

---
Machine-readable: https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.