Zyxel fixes zero-day exploited in attacks against GS1900 switches

# Zyxel fixes zero-day exploited in attacks against GS1900 switches

https://gcdradar.vercel.app/incidents/zyxel-fixes-zero-day-exploited-in-attacks-against-gs1900-swi · AIR-2026-1777 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Confirmed exploitation in the wild against multiple devices.
- Fix status: Patched
- First reported: 2026-11-04
- AI role: No AI role
- Products: Zyxel GS1900 series network switches
- CVE ids: CVE-2026-107441, CVE-2026-7273

## Summary

Zyxel patched a zero-day flaw in its GS1900 series switches that attackers actively exploited to compromise nearly 1,000 devices. The breach allowed attackers to exfiltrate configuration files and credentials.

## What to do

Update Zyxel GS1900 series switches to the latest firmware immediately.

## Affected and fixed versions

- Affected: Zyxel GS1900 series
- Fixed in: latest firmware

## Latest updates

- 2026-11-05: Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441) (https://helpnetsecurity.com/2026/11/05/zyxel-cve-2026-107441-exploit)
- 2026-11-05: Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution (https://thehackernews.com/2026/11/zyxel-gs1900-patch-fails-to-block-zero.html)
- 2026-11-05: Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day (https://securityweek.com/zyxel-switch-hacks-blamed-on-patched-flaw-actually-exploited-a-zero-day)
- 2026-11-04: Zyxel fixes zero-day exploited to hack nearly 1,000 network switches (https://bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches)

## Sources

- 2026-11-04 BleepingComputer: Zyxel fixes zero-day exploited to hack nearly 1,000 network switches https://bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches
- 2026-11-05 SecurityWeek: Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day https://securityweek.com/zyxel-switch-hacks-blamed-on-patched-flaw-actually-exploited-a-zero-day
- 2026-11-05 The Hacker News: Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution https://thehackernews.com/2026/11/zyxel-gs1900-patch-fails-to-block-zero.html
- 2026-11-05 Help Net Security: Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441) https://helpnetsecurity.com/2026/11/05/zyxel-cve-2026-107441-exploit

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.