Zyxel GS1900 Switches Still Exploitable After the First Patch: What Network Teams Should Do

Binarly researchers found that Zyxel GS1900 switches carrying the vendor's earlier fix remained open to the exploit attackers used. The fix addressed CVE-2026-7273, while the working exploit relies on a different out-of-bounds write in the web CGI program, now tracked as CVE-2026-107441. The switch maker has since shipped new firmware, according to Help Net Security (November 5, 2026).

What Happened and When

Zyxel published an advisory on June 16, 2026 for CVE-2026-7273 and shipped 2.90 Patch 2 firmware. CISA added that flaw to its Known Exploited Vulnerabilities catalog on September 21 after GreyNoise reported attacks. Binarly then showed the real exploit still worked on every Patch 2 release.

• June 16: Zyxel advisory and Patch 2 firmware for CVE-2026-7273.
• September 21: GreyNoise reports exploitation; CISA's KEV catalog lists CVE-2026-7273. GreyNoise said attackers took data from 996 switches around August 17.
• September 29: Binarly reports the new flaw to Zyxel after testing an exploit found on an attacker server.
• Late October: Zyxel releases Patch 3 firmware. Sources give October 22 and October 23 for the release date.
• Week of November 2: Zyxel publishes its advisory for CVE-2026-107441.

The Hacker News (November 5, 2026) noted that neither GreyNoise nor Binarly says the compromised switches were running the earlier fix, and Zyxel's advisory does not say whether the new flaw has been exploited. Treat the evidence carefully: the exploit works against Patch 2 builds, but the earlier victims may have been compromised through the older flaw.

Which Switches Are Affected?

Ten GS1900 switch models are affected when they run 2.90 Patch 2 firmware, written as 2.90(XXXX.2)C0, or anything earlier. The corrective build for each model ends in .3, meaning Patch 3. Zyxel's advisory lists the exact firmware strings per model.

An unauthenticated attacker who can reach the web management interface can execute operating system commands with a crafted HTTP request. That makes the management plane exposure, not the switch's data plane, the key risk. Details are in The Hacker News report.

Why It Matters for B2B SaaS Buyers and IT Teams

This is a reminder that a patched advisory is not the same as a verified fix. Edge and branch switches often sit outside endpoint tooling, so they receive firmware updates late and rarely get independent verification.

For teams buying managed network services or monitoring platforms, the lesson is to ask vendors how they track firmware versions, detect exposed management interfaces and confirm that vendor patches are the right ones. NIST's SP 800-40 Revision 4 treats patch verification as part of the process, not an optional step.

What to Do Now: A Checklist

Inventory every Zyxel GS1900 switch, confirm its firmware, and upgrade each to the Patch 3 build for its model. Then restrict who can reach the web management interface and review the devices for signs of tampering.

• List GS1900 switches and read the firmware version, comparing against the per-model table in the vendor advisory.
• Upgrade to 2.90(XXXX.3)C0 for your model; Patch 2 is not sufficient.
• Block management access from the internet and untrusted VLANs, and allow only a dedicated admin network.
• Change default and shared credentials, and rotate any that were stored on affected switches.
• Back up and review switch configurations for unexpected changes, using a network configuration management tool if you have one.
• Alert on firmware drift and on management traffic from unexpected sources.

Related SaaSPodium Categories and Guides

Firmware and configuration tracking sit between network monitoring and patch management tooling, and branch switches are often the blind spot in both. If you lack visibility into them, start with these resources.

• Network monitoring software and our guide to switch port monitoring software.
• Patch management software and best patch management tools.
• Related news: Cisco ASA and FTD flaw exploited.

Frequently Asked Questions

Is Patch 2 firmware enough to protect a Zyxel GS1900 switch?
No. Reports from Help Net Security and The Hacker News say the exploit still worked on all ten Patch 2 releases. Upgrade to the Patch 3 build for your model and restrict management access.

Has CVE-2026-107441 been confirmed as exploited in the wild?
Not by Zyxel. Its advisory does not say whether the new flaw has been exploited, and researchers have not said the compromised switches ran the earlier fix. Binarly found a working exploit for it on an attacker server, so treat it as urgent.

What is the fastest way to reduce risk before upgrading?
Remove internet and untrusted network access to the switch web management interface, limit it to a dedicated admin network, and change default credentials. Then schedule the Patch 3 upgrade for every affected model.