Zyxel patches zero-day exploited to compromise nearly 1,000 GS1900 switches

Zyxel has patched a zero-day vulnerability in its GS1900 series network switches. The flaw, tracked as CVE-2026-107441, is an out-of-bounds write in the web management interface that allows an unauthenticated attacker with network access to execute operating system commands. It affects ten GS1900 models. Zyxel released security updates on 22 October 2026 and published a security advisory on 3 November 2026.

GreyNoise observed a suspected Chinese-speaking threat actor it tracks as Kapibala exploiting Zyxel switches from around 17 August 2026. The attackers compromised 996 devices across 48 countries, executed commands remotely and downloaded a script that collected device configurations, hashed root credentials and network information. GreyNoise linked Kapibala to the Red Heron campaign, which Acronis previously reported was exploiting a critical vulnerability in the self-hosted Git service Gitea.

The exploitation was initially attributed to CVE-2026-7273, a flaw Zyxel patched on 16 June 2026 and that CISA added to its Known Exploited Vulnerabilities catalog. Researchers at Binarly found that the exploit actually targeted a separate, previously unknown vulnerability. Binarly confirmed on 28 September 2026 that the exploit remained effective against all ten firmware releases patched for CVE-2026-7273. Binarly reported the finding to Zyxel on 29 September, and Zyxel confirmed the new vulnerability on 11 October. Administrators are advised to install the latest firmware.

Why it matters Organizations running Zyxel GS1900 switches cannot rely on the June patch for CVE-2026-7273 to block this exploit, since the exploit still worked against those firmware versions according to Binarly. Asset owners should confirm which firmware their GS1900 devices run and apply the October 22 updates. Investigators reviewing switch compromises should check configuration files and root credential exposure, as the reported script collected both.