As reported by BleepingComputer, Zyxel has patched a zero-day vulnerability (CVE-2026-107441) in its GS1900 series network switches that was actively exploited to compromise nearly 1,000 devices across 48 countries. The flaw is an out-of-bounds write in the web management interface allowing unauthenticated remote code execution. What makes this case remarkable is not just the scale of compromise — it's the months-long gap during which the cybersecurity industry believed the threat was neutralized.
Vulnerability Details
| Field | Details |
|---|---|
| CVE ID | CVE-2026-107441 |
| Type | Out-of-bounds write (pre-auth RCE) |
| Attack Vector | Network — crafted HTTP requests to web management interface |
| Authentication | None required |
| Affected Products | Zyxel GS1900 series — 10 switch models (all firmware versions, including those patched for CVE-2026-7273) |
| Patch Available | Yes — Zyxel released updates October 22, 2026; advisory published November 3, 2026 |
| Active Exploitation | Yes — 996 confirmed compromises by Kapibara threat actor (Red Heron campaign) |
| Related CVE | CVE-2026-7273 (June 2026 patch — did NOT remediate this flaw) |
Why This Matters: The Patch Confidence Trap
The most significant takeaway from this incident is how a flawed assumption — that June's patch for CVE-2026-7273 fully neutralized the attack — created a dangerous blind spot lasting over three months. GreyNoise and CISA both attributed ongoing exploitation to the already-patched vulnerability. The reality was far more troubling: Binarly's investigation revealed that the Kapibala exploit specifically targeted firmware versions patched for CVE-2026-7273, confirming that the June fix was incomplete.
The June patch added buffer overflow checks, but attackers found they could corrupt a parameter counter before validation occurred, bypassing the mitigation entirely. This is a textbook case of a patch that addressed the symptom but not the root cause — and threat actors were quick to weaponize the gap.
The exploit was designed to check for and specifically target firmware versions that had already been patched for CVE-2026-7273. Attackers weren't exploiting an old flaw — they were exploiting a residual flaw that the patch failed to close.
Who Is At Risk
The Kapibala threat actor harvested configuration files, hashed root credentials, and network topology data from compromised switches. In a managed service provider context, stolen credentials could facilitate lateral movement into multiple customer networks, dramatically expanding blast radius.
Broader Implications
This incident underscores a systemic problem in vulnerability management: the assumption that a vendor patch equals full remediation. Binarly's firmware analysis revealed what runtime monitoring and network telemetry could not — that the exploit continued to work against patched firmware. This argues for independent post-patch validation, particularly for critical infrastructure components where exploit reliability is high.
Additionally, the connection to the Red Heron campaign — previously linked to Gitea exploitation — suggests a coordinated effort targeting edge infrastructure components. Network switches, code repositories, and similar perimeter assets are high-value targets because they sit at trust boundaries and often receive less scrutiny than servers and endpoints.
Shield53 Recommendations
Immediate Actions
- Patch now: Apply Zyxel's October 22 firmware updates to all GS1900 series switches. Do not assume June patches provide protection.
- Isolate management interfaces: Restrict web management access to dedicated management VLANs. Disable the web GUI entirely if CLI management is feasible.
- Hunt for compromise: Check for unexpected configuration downloads, new cron jobs, or unfamiliar scripts on all GS1900 switches. Look for signs of JITTERLY backdoor or SIXZUT rootkit artifacts.
- Rotate credentials: If any GS1900 switch was potentially exposed — even if patched in June — rotate all stored credentials and assume configuration data was exfiltrated.
- Review CISA KEV compliance: While CISA added CVE-2026-7273 to the KEV catalog in September, organizations must now also address CVE-2026-107441. Update internal tracking accordingly.
Strategic Actions
- Implement post-patch validation: For critical network infrastructure, validate patches using exploit reproduction or firmware analysis rather than assuming vendor fixes are complete.
- Segment network switch management: Treat switch management planes as privileged infrastructure. No switch web interface should be reachable from user networks or the internet.
- Inventory edge devices: Maintain an authoritative inventory of all network infrastructure by vendor, model, firmware version, and management exposure. This incident shows how quickly edge devices become attack vectors.
