Zyxel has patched a zero-day vulnerability in its GS1900 series network switches after hackers used it to compromise nearly 1,000 devices around the world and steal configuration files and credentials. The flaw, tracked as CVE-2026-107441, is an out-of-bounds write weakness in the switches' web management interface.

An unauthenticated attacker with network access could send specially crafted web requests and run operating-system commands on the switch. Zyxel rates the flaw 8.8 out of 10 in severity. It affects ten GS1900 models, and Zyxel released fixed firmware on 22 October 2026 and published its security advisory on 3 November.

Why the June patch was not enough

The attacks were first blamed on a different flaw, CVE-2026-7273, which Zyxel patched in June 2026 and CISA added to its exploited-vulnerabilities list in September. But researchers at firmware security firm Binarly found the real exploit still worked on switches running the June firmware, because it abused a separate weakness in how web-request parameters were checked.

GreyNoise, which first reported the campaign, says a suspected Chinese-speaking actor it tracks as Kapibala began exploiting Zyxel switches around 17 August 2026 and compromised 996 devices across 48 countries. The attackers downloaded a script that collected device configurations, hashed root credentials and network information. Binarly confirmed on 28 September that the exploit still worked against all ten firmware releases carrying the June fix, reported its findings to Zyxel on 29 September, and Zyxel confirmed the new flaw on 11 October.

What switch owners should do

Install the October 2026 firmware for your exact GS1900 model from Zyxel's own support site, and check the version shown in the switch's web page. Because attackers took configuration files and password hashes, change admin passwords and any shared passwords or SNMP strings in the configuration. Keep the switch management page off the internet and off guest and user networks, on its own VLAN where possible.

Sources: BleepingComputer, Zyxel fixes zero-day exploited to hack nearly 1,000 network switches, 4 November 2026; Carthage Electronics, November 4 2026 CVE Threat Brief, 4 November 2026.