Zyxel GS1900 CVE-2026-107441: Patch Bypass Explained

A patch isn't always the end of the story: Zyxel just shipped a second emergency fix for its GS1900 switch line after attackers updated their exploit to get around the first one. Here's what CVE-2026-107441 and CVE-2026-7273 mean for anyone running GS1900 switches, and why relying on one vendor for your edge stack raises the stakes when that happens.

What is CVE-2026-107441 in Zyxel GS1900 switches?

CVE-2026-107441 is an out-of-bounds write vulnerability in the CGI web-management program of Zyxel GS1900 series switches. According to the CVE record and Zyxel's advisory (published November 3, 2026), it lets an unauthenticated, network-adjacent attacker execute OS commands via a crafted HTTP request. The flaw carries a CVSS 3.1 score of 8.8 (vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects ten GS1900 models. Firmware security firm Binarly reported the bug to Zyxel on September 29, 2026; Zyxel confirmed it on October 11 and released fixed firmware on October 22.

How CVE-2026-107441 relates to the earlier CVE-2026-7273 patch bypass

The reason this is more than a routine firmware update is the backstory. Zyxel had already patched a separate, pre-authentication stack-based buffer overflow — CVE-2026-7273 — in GS1900 switches on June 16, 2026. Starting around August 17, GreyNoise observed a suspected China-nexus actor it tracks as Kapibala exploiting Zyxel switches; by the time GreyNoise disclosed the campaign on September 21, it had linked the activity to roughly 996 compromised GS1900 devices across 48 countries, per BleepingComputer's reporting. CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog that same day, giving federal agencies until September 24 to patch.

Binarly researchers then found an exposed exploit archive, tied to infrastructure using the JITTERLY backdoor and SIXZUT rootkit, and discovered the exploit specifically checked whether target firmware had already been patched for CVE-2026-7273 — and worked anyway. The earlier patch added checks against the original buffer overflow, but attackers could corrupt a parameter counter before validation, achieving the same unauthenticated code execution through a different path. Zyxel treated this as a distinct vulnerability, assigned CVE-2026-107441, and shipped new firmware on October 22 that limits parameter sizes and validates parameter counts before copying data into memory.

Who is affected by this Zyxel GS1900 vulnerability?

Publicly documented impact covers ten GS1900 switch models and firmware lines up to and including the 2.90(AAHK.2)C0-equivalent builds for each model, per the NVD CVE record sourced from Zyxel.

Mitigation, per Zyxel and Binarly: install the firmware Zyxel released on October 22, 2026 for the affected GS1900 models. Where immediate patching isn't possible, restrict management-interface access to trusted, segmented networks only — the flaw requires only network adjacency, not authentication. For a refresher, see our guide to network segmentation and access control.

Reducing single-vendor exposure beyond network switch security

GS1900 switches aren't remote-access VPNs, so this isn't a "swap your VPN" story — it's a vendor-concentration story. When a single vendor's switch line gets hit twice in one quarter, with a second exploit specifically engineered to beat the first patch, it's a useful prompt to ask how much of your edge infrastructure — switches, firewalls, remote access — sits on one vendor's code base.

If a Zyxel-based segment of your network needs to be isolated or rebuilt during an incident, having remote administrative access that doesn't depend on the affected gear matters. OpenVPN Access Server can run as a vendor-diverse, standby self-hosted remote access VPN layer for exactly this kind of scenario — built on a different code base than your switching vendor, so an edge-device compromise doesn't also take out your way back in. For teams moving toward cloud-delivered access control generally, CloudConnexa offers cloud-delivered zero trust network access that is similarly independent of on-prem switch and VPN appliance firmware. Neither replaces patching Zyxel gear — they reduce how much damage a repeat incident on one vendor's line can do to your overall access posture. Learn more about how a zero trust network access model limits that blast radius.

FAQ

What is CVE-2026-107441?

It's an out-of-bounds write vulnerability in the CGI web-management program of Zyxel GS1900 series switches, allowing an unauthenticated, network-adjacent attacker to execute OS commands via a crafted HTTP request, per Zyxel's November 3, 2026 advisory.

Is CVE-2026-107441 the same as CVE-2026-7273?

No. CVE-2026-7273 was a stack-based buffer overflow Zyxel patched in June 2026 and which CISA added to its KEV catalog on September 21, 2026. Binarly found that attackers updated their exploit to bypass that patch, and Zyxel classified the bypass technique as a separate, new vulnerability, CVE-2026-107441.

Which Zyxel switches are affected by CVE-2026-107441?

Publicly documented impact covers ten GS1900 series models (GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48, and -48HPv2) running firmware up to the versions listed in Zyxel's advisory and the NVD CVE record.

Has CVE-2026-107441 been exploited in the wild?

Binarly discovered the exploit during research into infrastructure tied to the Red Heron campaign's JITTERLY backdoor and SIXZUT rootkit, and reported it to Zyxel on September 29, 2026. Publicly documented impact for the predecessor flaw, CVE-2026-7273, included roughly 996 compromised GS1900 devices across 48 countries, per GreyNoise's findings as reported by BleepingComputer; sources reviewed did not confirm independent in-the-wild exploitation counts specific to CVE-2026-107441 itself.

What should GS1900 administrators do now?

Install the firmware Zyxel released on October 22, 2026, for the affected GS1900 models, and restrict management-interface access to trusted, segmented networks in the meantime, per Zyxel's and Binarly's guidance.