Zyxel fixes zero-day exploited to hack nearly 1,000 network switches

Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that was exploited to compromise nearly 1,000 devices worldwide. The flaw, tracked as CVE-2026-107441, is an out-of-bounds write in the web management interface that lets an unauthenticated attacker execute operating system commands via crafted HTTP requests. It affects ten GS1900 models, and Zyxel released firmware updates on October 22 that limit parameter sizes and validate counts, preventing the exploitation technique. The attacks were linked to a suspected Chinese-speaking threat actor, Kapibala, who used the flaw to download scripts that collected configurations, hashed root credentials and network information. Researchers at Binarly discovered the exploit bypassed earlier patches for CVE-2026-7273 and confirmed it remained effective until Zyxel’s October 22 update. ¹