Network operators are facing a fresh headache as attackers bypassed Zyxel's latest security patch on its GS1900 series switches. While the vendor addressed CVE-2026-107441 as a known out-of-bounds write flaw, researchers confirmed that a separate zero-day vulnerability remained unpatched and was actively used to compromise nearly 1,000 devices. SecurityWeek reports that hackers exploited this hidden weakness before vendors could release a fix, allowing them to execute OS commands without authentication.
This situation underscores the limits of vendor patch cycles. Even when a specific flaw is tracked and patched, lateral movement tools often find other gaps. The BleepingComputer notes that earlier firmware versions failed to stop the initial exploit, forcing a rushed update. For IT leads, this means relying on vendor timelines is risky when a zero-day is involved. CISA has flagged similar active exploits across other platforms, reinforcing the need for immediate verification beyond simple CVE tracking.
What happened
Zyxel on Thursday released new firmware updates for 10 models of its GS1900 series network switches to address a zero-day vulnerability that was initially reported as patched but was actually exploited in the wild. The flaw, tracked as CVE-2026-107441, is an out-of-bounds write vulnerability that could allow attackers to execute OS commands via crafted HTTP requests.
On October 28, 2026, Zyxel released firmware version 2.90 for the affected switches, stating that it addressed the vulnerability tracked as CVE-2026-107441. However, researchers at Binarly discovered that the update did not fully resolve the issue, and the vulnerability remained exploitable, allowing attackers to execute arbitrary commands on the switches without authentication.
Zyxel recognized the issue and released new firmware updates on November 4, 2026, for the following 10 models: USG FLEX 100, USG FLEX 200, USG FLEX 500, USG FLEX 700, USG FLEX 50-W, USG FLEX 100-W, USG FLEX 200-W, USG FLEX 500-W, USG FLEX 700-W, and USG FLEX 50-W. These updates are critical for users to install in order to protect their networks from potential attacks exploiting this vulnerability.
The vulnerability was initially reported as patched, but it was actually a zero-day flaw that was being actively exploited. This highlights the importance of thorough testing and validation of patches to ensure that vulnerabilities are truly resolved.
phpWhy it matters
The discovery that a previously patched flaw in Zyxel network switches was actually being exploited via a zero-day vulnerability highlights the ongoing challenges faced by businesses and IT teams in keeping their systems secure. This incident underscores the importance of staying vigilant and regularly monitoring for signs of compromise, as well as the need to promptly address and patch known vulnerabilities to minimize the risk of exploitation.
Moreover, the fact that attackers were able to execute OS commands on affected devices through crafted HTTP requests underscores the potential severity of such vulnerabilities and emphasizes the need for organizations to implement robust security measures to prevent unauthorized access and command execution.
The inclusion of this vulnerability in the CISA's Known Exploited Vulnerabilities catalog further demonstrates the real-world impact of zero-day vulnerabilities and the critical importance of prioritizing the remediation of such flaws to protect against potential attacks.
Lastly, the exploitation of a patched flaw in this case highlights the limitations of relying solely on software vendors to identify and address security issues, and emphasizes the need for organizations to adopt a proactive approach to security by conducting regular vulnerability assessments and implementing effective security controls to mitigate the risk of exploitation.
pythonWhat to do
- Ensure all Zyxel GS1900 series switches are updated to the latest firmware, version V2.90(F.11) or later, to mitigate the zero-day vulnerability.
- Review network configurations and restrict access to management interfaces to only authorized IP addresses to limit potential attack vectors.
- Monitor for unusual network traffic or suspicious activity that may indicate compromise, and implement intrusion detection systems to help identify potential breaches.
- Conduct regular security audits and vulnerability assessments to identify and remediate any other weaknesses in the network infrastructure.
- Provide end-users with security awareness training to help them identify and report potential phishing attempts or social engineering tactics used by attackers.
2TI Lens
The discovery of a zero-day vulnerability in Zyxel network switches highlights the ongoing threat of unpatched security flaws in enterprise hardware. Despite the company's patch for CVE-2026-107441, attackers were still able to exploit the vulnerability, underscoring the importance of promptly addressing software vulnerabilities to mitigate potential risks. As organizations continue to rely on network devices for critical operations, the need for comprehensive security measures and regular updates becomes increasingly apparent. This incident also emphasizes the need for enterprises to stay vigilant and proactive in identifying and addressing potential security threats, as well as the importance of collaboration between vendors and security researchers to ensure the swift remediation of vulnerabilities.