Zyxel GS1900 CVE-2026-107441: The Patch That Didn't Stop the Breach

Zyxel GS1900 CVE-2026-107441 is a newly disclosed out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E switch firmware that attackers have been exploiting as a pre-authentication remote code execution flaw, even after organizations patched the unrelated CVE-2026-7273 that vendor advisories and KEV listings credited for the same attacks.

Key takeaways

• CVE-2026-107441 is a distinct, unauthenticated out-of-bounds write RCE in GS1900-24E firmware, separate from the CVE-2026-7273 flaw Zyxel patched in June 2026.
• Nearly 1,000 Zyxel GS1900 switches were compromised in the wild even after owners applied the original patch, according to gbhackers and elhacker.net.
• Zyxel has shipped a third firmware patch to close the bypass; devices still on the first or second round of fixes remain exposed, per SOCRadar.
• Patch compliance tools marked these switches as remediated while the CGI endpoint kept accepting unauthenticated commands, a gap only behavior-based monitoring would have surfaced.

What happened with the Zyxel GS1900 switches?

Zyxel GS1900-24E is a managed network switch widely deployed by small businesses and local networks. In November 2026, researchers confirmed that attacks blamed on an already-patched vulnerability were in fact exploiting a different, previously unknown bug. Rapid7's vulnerability database describes it as an out-of-bounds write in the switch's CGI program affecting firmware through version 2.90(AAHK.2)C0.

Ostorlab's analysis and Binarly's advisory both confirm the flaw allows unauthenticated remote code execution, meaning an attacker needs no credentials to reach root-level commands on an exposed device. The Hacker News reported the bug lets attackers run commands as root through the management interface.

Why did the June patch fail to stop exploitation?

The June 2026 patch failed because it closed a different hole than the one attackers were actually using. Earlier in 2026, SecurityWeek reported that a Chinese-nexus actor was exploiting a Zyxel switch vulnerability tracked as CVE-2026-7273. Zyxel patched that flaw, it was added to vendor and KEV-style tracking, and defenders treated the matter as closed.

It wasn't. eSecurityPlanet's reporting and SecurityWeek's follow-up found that attacks continuing after the patch were not resurfacing CVE-2026-7273 at all. They were abusing a second, unrelated out-of-bounds write bug in the same CGI program, now assigned CVE-2026-107441. Help Net Security summarized it plainly: patched switches remained open to in-the-wild exploitation because the patch never touched the actual bug being used.

This is a vulnerability misattribution problem, not a patching-speed problem. Fast patching only protects against the specific flaw a patch addresses. If the CVE assigned to an attack campaign is wrong, the patch can ship on time and the breach continues anyway.

Who's behind the attacks, and what did they do?

The campaign targeting Zyxel GS1900 switches has run for months under at least one identified actor. SecurityWeek's September 2026 reporting tied early exploitation to a Chinese-nexus group. Separate GreyNoise research referenced in coverage of the actor known as Kapibala and summarized on X by Dark Web Intelligence describes a suspected Chinese-speaking actor tied to "Red Heron" running a months-long campaign that combined WordPress wp2shell webshell deployment, used to steal more than 18,000 government records, with active exploitation of the Zyxel flaw.

By November 2026, the scale of device compromise had grown. gbhackers and elhacker.net both report nearly 1,000 Zyxel network switches compromised. Cybersecuritynews confirms hijacking continued even after organizations believed they had closed the hole with the original June patch.

What should MSSPs and partners do now?

First, confirm firmware is current against the latest patch, not the one issued in June. SOCRadar and Security Online both note Zyxel's third patch round specifically targets the bypass. A device patched only against CVE-2026-7273 is not protected against CVE-2026-107441.

Second, treat every network switch, router, and management appliance as a monitored asset, not a set-and-forget box. Vuldb's entry and OffSeq's threat radar both classify this as a pre-auth RCE reachable over the management interface, which means exposed switches are internet-reachable targets by default in many small business networks.

Third, audit what "patched" actually means in your tooling. If a patch management system marked a device compliant based on the CVE-7273 fix, that compliance status tells you nothing about CVE-2026-107441 exposure. Strix.ai's writeup and Privacy Needle both underline that the two bugs live in the same CGI program but are functionally separate issues.

Why patch compliance isn't proof of safety

This incident is the exact blind spot that CVE-tracking alone cannot close. An organization sees a Zyxel advisory, applies the patch tied to CVE-2026-7273, and marks the device remediated. Meanwhile the device keeps accepting unauthenticated commands through a different bug nobody was watching for yet, because nobody had named it.

Patch status is a compliance answer. It is not a behavior answer. A switch that is "fixed" on paper can still be phoning home to an attacker's infrastructure, still be dropping a webshell through its CGI endpoint, still be running commands it has no business running. CVE tracking tells you what should be fixed. Only something watching egress traffic and command execution patterns in real time tells you what is actually still happening on the box.

That is the gap Vijilan Security's Global SOC is built to close. 24/7 SOC monitoring does not stop at confirming patch status. It watches for the behavior that indicates compromise regardless of what the vendor advisory says is resolved, unusual outbound connections from infrastructure devices, unexpected process execution, command patterns inconsistent with normal device function. ThreatHunt™ proactively looks for exactly this kind of lingering access on devices everyone assumed were clean. And when a device like a Zyxel switch is actively compromised, ThreatRespond™, Vijilan's managed XDR offering, correlates that device activity against the rest of the environment instead of treating the switch as an isolated, already-solved problem.

Next step

If your patch management dashboard says a device is fixed, that is a claim worth verifying, not a conclusion worth trusting blindly. Read why Vijilan pairs vulnerability awareness with behavior-based monitoring so a mislabeled CVE never becomes your organization's blind spot.