Zyxel GS1900 Zero-Day Bypasses June Patch on Nearly 1,000 Switches

A Zyxel GS1900 zero-day was exploited against nearly 1,000 devices, according to cybersecurity firm Binarly, and the June patch many administrators installed did not stop it. The attacks relied on a separate flaw, CVE-2026-107441, which Zyxel fixed in firmware posted on October 23. Binarly and Zyxel both published on November 3, and coverage was still spreading on November 5 and 6.

For anyone running these switches, the practical questions are simple: is the firmware current, and did the June update make the device safe? The answer to the second question is no, and that is the most important detail in this story.

Why the June patch did not stop the attacks

The earlier bug is CVE-2026-7273, which Zyxel fixed with Patch 2 on June 16. Binarly says the GS1900 software stored parameters in a fixed-size memory area and did not properly check their lengths before copying them. The June patch added a parameter-count check, but it ran too late to close the gap.

The timeline makes the failure worse. The first CVE-2026-7273 patch shipped 140 days before the advisory for the new flaw, according to Ostorlab's analysis. Binarly also found all ten fixed releases still vulnerable 104 days after that first patch. Those numbers point to a fix that did not hold, not a single missed update.

Patch bypasses have come up repeatedly in this news cycle. They weaken the usual advice to install the update and move on. For network gear, a patch is only a claim until someone tests it against the actual exploit path.

Which Zyxel GS1900 switches are affected

The new flaw affects 10 GS1900 switch models, and Zyxel's advisory lists them. Check your exact model against that list rather than assuming a series name covers every unit.

The exposure may be wider than the sites that skipped the June fix. The Hacker News reports that neither researcher says the attacked switches were running the earlier fix. That means an administrator who installed June's update should not treat it as a clean bill of health.

The headline count comes from BleepingComputer, which reports nearly 1,000 compromised devices. A secondary report from Tech-Insider puts the figure at 996 switches across 48 countries. That number could not be checked against Binarly's own text, so treat the exact count as unsettled.

No US-specific victim count appears in the reporting so far. Still, many US businesses and government agencies run managed switches like these, so American administrators should treat the flaw as in scope.

How the exploit reaches the switch

According to Zyxel, the flaw is an out-of-bounds write in the CGI program of the GS1900 firmware. An unauthenticated attacker can send crafted HTTP requests to achieve operating system command execution, as SecurityWeek reports. The Hacker News describes the result as root command execution.

The severity scores differ. Zyxel rates the flaw 8.8 on CVSS, while Binarly rates it 9.8. Cybersecurity News reports that Binarly says the flaw sits in global memory and can be reached over normal HTTP from any network that can reach the switch, which is why it scores higher.

For administrators, the practical lesson is about network placement. A switch's web management interface is part of its attack surface. If that service is reachable from a network you do not control, attackers can reach the switch too, regardless of which firmware it runs.

Who was behind the attacks and what is still unclear

Earlier reports tied the activity to a threat actor tracked as Red Heron, which deployed Jitterly and Sixzut malware while allegedly exploiting CVE-2026-7273, according to ThaiCERT. Initial investigations had wrongly blamed an older vulnerability that already had patches available. Binarly says earlier attribution pointed to a Chinese group, while ThaiCERT names Red Heron. No independent confirmation of the actor is available, so treat both labels as contested.

Binarly also reportedly found a working exploit tied to infrastructure linked to JITTERLY, a Linux backdoor with more than 30 commands. That connection matters because JITTERLY is a full-featured backdoor, not a single-purpose tool.

Exploitation status is also disputed. Binarly says the flaw was exploited as a zero-day. The vendor's advisory, as described in coverage, does not say whether the new flaw has been exploited. That gap affects how urgently some teams will treat the fix.

Timeline and CISA status

• June 16: Zyxel ships Patch 2 for CVE-2026-7273.
• September: CISA adds CVE-2026-7273 to its Known Exploited Vulnerabilities catalog.
• September 29: Binarly reports the new flaw to Zyxel.
• October 11: Zyxel confirms the flaw and assigns CVE-2026-107441.
• October 23: Zyxel posts 2.90 Patch 3 firmware.
• November 3: Zyxel's advisory and Binarly's findings go public.
• As of November 4: CVE-2026-107441 is not in CISA's KEV catalog.

The KEV gap matters because listings in that catalog typically trigger federal remediation deadlines. The sources do not say whether CISA will add the new flaw, or when, so any federal deadline remains unknown.

What administrators should do now

• Check whether your GS1900 model is one of the 10 listed in Zyxel's advisory.
• Install the 2.90 Patch 3 firmware on affected models. Patch 2 does not cover this flaw.
• Limit web management access to trusted networks. This is my recommendation, not a vendor instruction, but the exploit needs only network reachability to the management service.
• Review devices for signs of compromise, including unknown backdoors and changed configuration. Reports describe stolen configuration files and credentials, so consider rotating administrator passwords once the review is done.

Run that review even if you installed the June update. The June fix did not close this flaw, so a June install does not prove a device is clean.

What to watch next

Three developments will answer most of the open questions. First, whether CISA adds CVE-2026-107441 to its KEV catalog and sets a federal deadline. Second, whether the device count stays near 1,000 or moves toward the 996 figure from the secondary report. Third, whether Zyxel's advisory or further Binarly analysis confirms that the new flaw has been exploited in the wild.

The broader pattern is familiar. Small networked devices keep getting backdoored and stay in service long after a fix ships. Google's move against the Videostrong app over an XCPE botnet backdoor found in 1.3 million TV boxes shows the same problem from the consumer side. Remote flaws that need no user action, like the Android bug Google patched recently, raise the stakes for every device on a network.