Zyxel has released security updates for a zero-day vulnerability in its GS1900 series network switches after GreyNoise reported that attackers had compromised 996 devices across 48 countries. The flaw, tracked as CVE-2026-107441, is an out-of-bounds write vulnerability in the web management interface that allows an unauthenticated attacker with network access to execute operating system commands using specially crafted HTTP requests.
The vulnerability was initially mistaken for an older flaw, CVE-2026-7273, which Zyxel had patched in June. Starting around August 17, cybersecurity firm GreyNoise observed a suspected Chinese-speaking threat actor, tracked as Kapibala, exploiting Zyxel switches. GreyNoise reported that 996 devices across 48 countries were compromised. The attacks were initially attributed to CVE-2026-7273, and CISA added that vulnerability to its Known Exploited Vulnerabilities catalog.
However, researchers at Binarly discovered that the exploit used in the attacks targeted a separate, previously unknown vulnerability that remained unpatched. While investigating Red Heron hacking infrastructure linked to the JITTERLY backdoor and SIXZUT rootkit, Binarly found an exposed archive containing an obfuscated Python exploit. The exploit specifically checked for firmware versions patched for CVE-2026-7273, indicating it had been developed or updated to target those versions.
Binarly confirmed on September 28 that the exploit remained effective against all ten firmware releases patched for CVE-2026-7273. Binarly found that the earlier security update added checks to prevent a buffer overflow, but attackers could bypass them by corrupting a parameter counter before it was validated. Binarly reported its findings to Zyxel on September 29, and the vendor confirmed the new vulnerability on October 11, assigning it CVE-2026-107441. On October 22, Zyxel released new firmware updates that limit parameter sizes and validate the parameter count before copying data into memory.
The threat actors used the exploit to remotely execute commands, download a script collecting device configurations, hashed root credentials, and network information. Administrators of affected GS1900 switches are advised to install the latest firmware updates to protect against CVE-2026-107441.
Analysis
Why This Matters
- Nearly 1,000 switches compromised worldwide, exposing network credentials and configurations that could enable further attacks.
- The flaw was initially misidentified, delaying the correct patch by months and leaving devices vulnerable.
- The ease of exploitation (unauthenticated remote command execution) makes it a serious risk for organisations relying on these switches.
Background
Zyxel GS1900 series switches are managed network switches commonly used in small and medium businesses. In June 2026, Zyxel patched a buffer overflow vulnerability (CVE-2026-7273) in the same models. Starting in August, GreyNoise observed attacks exploiting what was thought to be that vulnerability, but Binarly later discovered a separate zero-day (CVE-2026-107441) that bypassed the June patch.
Key Perspectives
GreyNoise: attributed the attacks to a suspected Chinese-speaking threat actor tracked as Kapibala, linked to the Red Heron hacking campaign. Initially, GreyNoise reported the exploitation as targeting CVE-2026-7273.
Binarly: discovered that the exploit did not target the patched vulnerability but a separate, previously unknown flaw in the GS1900 switches. Binarly confirmed that the exploit remained effective against all firmware versions patched for CVE-2026-7273.
Zyxel: confirmed the new vulnerability on October 11, assigned CVE-2026-107441, and released firmware updates on October 22 that prevent the exploitation technique.
What to Watch
- Whether the threat actor Kapibala shifts to other targets or develops new exploits for similar devices.
- How quickly organisations apply the October firmware updates, given the earlier patch was already ineffective.
- Potential CISA action, such as adding CVE-2026-107441 to the Known Exploited Vulnerabilities catalog.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedZyxel patched a zero-day exploited to compromise nearly 1,000 network switches.BleepingComputer: “Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide”
- SupportedThe flaw in the GS1900 series was initially mistaken for an older vulnerability that Zyxel had already patched.BleepingComputer: “However, the vulnerability was initially mistaken for an older flaw that Zyxel had already patched months before the attacks began.”
- SupportedGreyNoise reported that attackers compromised 996 devices across 48 countries.BleepingComputer: “Starting around August 17, cybersecurity company GreyNoise observed a suspected Chinese-speaking threat actor tracked as Kapibala exploiting Zyxel switches, reporting that the attackers compromised 996 devices across 48 countries.”
- SupportedCVE-2026-107441 is an out-of-bounds write flaw in the web management interface that lets an unauthenticated attacker with network access execute operating system commands using specially crafted HTTP requests.BleepingComputer: “The vulnerability, tracked as CVE-2026-107441, is an out-of-bounds write flaw in the switches' web management interface that allows an unauthenticated attacker with network access to execute operating system commands using specially crafted HTTP requests.”
- SupportedStarting around August 17, GreyNoise observed a suspected Chinese-speaking threat actor tracked as Kapibala exploiting Zyxel switches.BleepingComputer: “Starting around August 17, cybersecurity company GreyNoise observed a suspected Chinese-speaking threat actor tracked as Kapibala exploiting Zyxel switches”
- SupportedThe attacks were initially attributed to CVE-2026-7273, and CISA added that vulnerability to its Known Exploited Vulnerabilities catalog.BleepingComputer: “When GreyNoise disclosed the campaign on September 21, it attributed the exploitation to CVE-2026-7273, the vulnerability Zyxel had patched in June. That same day, CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog”
- SupportedBinarly researchers discovered that the attack exploit targeted a separate, previously unknown vulnerability that remained unpatched.BleepingComputer: “However, researchers at firmware security company Binarly discovered that the exploit used in the attacks actually targeted a separate, previously unknown vulnerability that remained unpatched.”
- SupportedThe exploit checked for firmware versions patched for CVE-2026-7273, indicating it had been developed or updated to target those versions.BleepingComputer: “After analyzing the exploit, the researchers found that it specifically checked for firmware versions patched for CVE-2026-7273, indicating the exploit had been developed or updated to target those versions.”
- SupportedBinarly confirmed on September 28 that the exploit remained effective against all ten firmware releases patched for CVE-2026-7273.BleepingComputer: “Binarly confirmed on September 28 that the exploit remained effective against all ten firmware releases patched for CVE-2026-7273.”
- SupportedAttackers could bypass the earlier update's buffer-overflow checks by corrupting a parameter counter before it was validated.BleepingComputer: “The researchers determined that the earlier security update added checks to prevent a buffer overflow, but attackers could bypass them by corrupting a parameter counter before it was validated.”
- SupportedBinarly reported its findings to Zyxel on September 29; Zyxel confirmed the new vulnerability on October 11 and assigned it CVE-2026-107441.BleepingComputer: “Binarly reported its findings to Zyxel on September 29, and the vendor confirmed the new vulnerability on October 11, assigning it CVE-2026-107441.”
- SupportedZyxel released new firmware updates on October 22 that limit parameter sizes and validate the parameter count before copying data into memory.BleepingComputer: “On October 22, Zyxel released new firmware updates that limit parameter sizes and validate the parameter count before copying data into memory, preventing the exploitation technique.”
