Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-4f5cab3822Early warningVulnerabilityReported, not confirmed

Zyxel patches zero-day exploited to hack nearly 1,000 GS1900 switches

BleepingComputer reports that Zyxel has patched a zero-day vulnerability in its GS1900 series switches. The report says attackers exploited it to compromise nearly 1,000 devices worldwide and steal configuration files and credentials.

Written by a model from the sources below. Verify against them.

Sources8Reported, not confirmed
Kind
Vulnerability
Vendor
Zyxel
Product
GS1900
Status
Reported, not confirmed
First seen

What to do

  • Install the patched firmware on all GS1900 series switches now.

  • Check switch logs and configurations for unexpected changes or unknown accounts.

  • Change any credentials that were stored on or used with affected switches.

  • Restrict management interface access to trusted networks only.

Timeline

  1. Made public by Mastodon
  2. First seen by cve.now1 day
  3. Record last updated

Evidence 8

  1. Social
    Mastodon
    “Zyxel GS1900 zero-day CVE-2026-107441 was exploited in the wild and bypasses the CVE-2026-7273 patch.”
    +2 more: Mastodon, Mastodon
  2. Social
    Mastodon
    “A flaw in Zyxel GS1900 switches was already being used by hackers, and the patch meant to fix it did not work.”
  3. Press
    BleepingComputer
    “Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials.”
    +1 more: BleepingComputer on Bluesky
  4. Social
    Bluesky
    “A previously unknown zero-day vulnerability in Zyxel GS1900 network switches has been exploited by cybercriminals to compromise nearly 1,000 devices across 48 countries.”
    +3 more: Bluesky, Bluesky, Bluesky
  5. Social
    Mastodon
    “Zyxel has finally dropped the patch — which is the res scroll you desperately need right now.”
Show all 8 sourcesShow fewer sources
  1. Social
    Mastodon
    “A zero-day flaw in Zyxel GS1900 network switches has been exploited in a massive hack, compromising 996 devices across 48 countries in a months-long intrusion campaign.”
  2. Social
    Bluesky
    “Zyxel GS1900: CVE-2026-107441 (OOB write, web admin) exploited as 0-day.”
  3. Social
    Bluesky
    “全世界で約1000台のデバイスが侵害されたという。”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

FAQ

Questions about SZB-4f5cab3822

Has Zyxel confirmed it?

Mastodon, Mastodon and BleepingComputer report it. No statement from Zyxel has reached cve.now yet.Source: Mastodon, Mastodon, BleepingComputer, Bluesky, Mastodon, Mastodon, Bluesky, Bluesky

What should Zyxel users do?

Install the patched firmware on all GS1900 series switches now. Check switch logs and configurations for unexpected changes or unknown accounts. Change any credentials that were stored on or used with affected switches. Restrict management interface access to trusted networks only.

Sources