Zyxel GS1900 switches: the earlier patch did not close the flaw and there is new firmware (CVE-2026-107441)

Published on November 10, 2026 · The mitza.es team

Switches are the devices that connect the computers, printers and access points in an office. Almost nobody thinks about them until they fail, and that is precisely why it is easy for them to go years without being updated. Zyxel's GS1900 series are managed switches designed for small-business networks. On November 3, 2026 Zyxel published a security advisory about a flaw in ten of them. We summarize it as of November 10, 2026, separating what the vendor says from what the media report.

What Zyxel says

The advisory (November 3, 2026) identifies the flaw as CVE-2026-107441 and describes it as an out-of-bounds write in the CGI program of the firmware: an unauthenticated attacker on the local network could run operating-system commands with a crafted HTTP request. Zyxel recommends installing the patches and thanks two researchers from the company Binarly for reporting it. The advisory does not say that the flaw is being exploited and proposes no measure other than installing the firmware, and it states that products not included in its table are not affected.

Why it is said that “the earlier patch was not enough”

The timeline reported by BleepingComputer (November 4), based on Binarly's research, is this:

• The GS1900 already had an earlier flaw, CVE-2026-7273 (a memory overflow), which Zyxel fixed with firmware from the “.2” series. GreyNoise documented its exploitation in a campaign: it compromised 996 switches in 48 countries and the activity began around August 17. According to BleepingComputer, CISA added it to its catalog of exploited vulnerabilities on September 21.
• On September 28 Binarly found that the exploit still worked against all ten firmware versions that had already been patched. The earlier fix added checks, but an attacker could get around them by altering a parameter counter before it was validated.
• Binarly reported it to Zyxel on September 29 and Zyxel confirmed it on October 11.
• According to BleepingComputer, Zyxel released new firmware on October 22 that limits the size of the parameters and validates their number before copying data into memory, and the public advisory came on November 3.

Is CVE-2026-107441 being exploited?

Here it pays to be precise. BleepingComputer's headline talks about a zero-day exploited to compromise almost 1,000 switches, but that figure and GreyNoise's attribution correspond to the campaign for the earlier flaw (CVE-2026-7273). Zyxel's advisory does not mention exploitation of the new flaw, and the link between the observed activity and CVE-2026-107441 rests on Binarly's analysis, which found an exploit in an exposed file. BleepingComputer also acknowledges that it is not clear whether the exploit was developed on purpose to get around the earlier fixes or takes advantage of a related flaw that those fixes did not cover. We have not been able to read Binarly's original publication or The Hacker News's, so we give the information as they report it.

For a small business, the practical consequence does not change: there is a serious flaw that allows command execution without authentication in a network device, there is a known exploit and there is fixed firmware. It is a priority update.

Affected models and fixed firmware

According to Zyxel's advisory, the “.2” firmware and earlier of the following ten models are vulnerable, and the fixed version is the “.3” of each:

• GS1900-8: 2.90(AAHH.3)C0
• GS1900-8HP: 2.90(AAHI.3)C0
• GS1900-10HP: 2.90(AAZI.3)C0
• GS1900-16: 2.90(AAHJ.3)C0
• GS1900-24: 2.90(AAHL.3)C0
• GS1900-24E: 2.90(AAHK.3)C0
• GS1900-24EP: 2.90(ABTO.3)C0
• GS1900-24HPv2: 2.90(ABTP.3)C0
• GS1900-48: 2.90(AAHN.3)C0
• GS1900-48HPv2: 2.90(ABTQ.3)C0

Always check the table in Zyxel's original advisory, which is the source that can be updated, and download the firmware only from the vendor's official site.

What to do: checklist

1. Identify your switches. Look at the label on the device or its web interface to find out the model and the installed firmware version.
2. Save the switch's configuration before updating, in case you need to restore it.
3. Install the fixed firmware for your model from Zyxel's official portal and plan a short outage window: the switch restarts and the network is interrupted for a few minutes.
4. Check the version after restarting and make sure all the ports work.
5. Don't leave administration open to the internet. This is a general recommendation of ours, not Zyxel's: a switch's web interface should only be reachable from an administration network, not from the whole office or from outside.
6. Change passwords and keys if the device was exposed or there are signs of access. According to BleepingComputer, in the campaign for the earlier flaw the attackers collected configurations and encrypted credentials from the device.
7. Record the change in your inventory with the date and the version.

Signs that something is wrong

• Configuration changes nobody remembers making (VLANs, users, administration settings).
• Access to the administration interface from addresses you don't recognize.
• Unexpected restarts or odd performance with no clear cause.

If you see anything like this, isolate the device, change credentials and ask your IT provider for help, or INCIBE (Spain's national cybersecurity institute) on 017.

What this case teaches a small business

Network equipment that sits “in a cupboard” needs maintenance too: firmware that is months or years old is an open door. We have seen the same with other edge devices, such as the Ivanti Connect Secure VPN, the Citrix NetScaler zero-days or the Cisco and FortiMail email gateways. If you want to understand what role each piece of the network plays, you have our guide to what a firewall is and what a small business needs. And to learn how to prioritize security advisories, the guide to reading an advisory and setting patching deadlines.

Quick questions

Does it affect me if I have another Zyxel model?

The advisory only lists the ten GS1900 models in the table and says that products not included are not affected. Even so, it is worth checking the firmware status of any network device.

Can I wait until the next maintenance window?

We don't recommend it: it is an unauthenticated command-execution flaw, an exploit exists and the campaign for the earlier flaw was wide. Do the update as soon as possible, in a short, planned outage.

Should I worry if the switch isn't reachable from the internet?

The advisory speaks of an attacker “on the local network”, so the main risk is that someone is already inside your network (an infected computer, a guest, a compromised camera). It is still advisable to update and to limit who can get into the administration.

How we can help at Mitza

We review your office network, update the firmware of the devices and leave administration protected and documented. See how we work in our IT maintenance for small businesses service or write to us from the contact page.

Related reading: the critical Linux kernel flaw (CVE-2026-98432) and the eighth Chrome zero-day of 2026.

See also: N-able N-central and what to ask your IT provider.