# SZB-4f5cab3822: Zyxel patches zero-day exploited to hack nearly 1,000 GS1900 switches

BleepingComputer reports that Zyxel has patched a zero-day vulnerability in its GS1900 series switches. The report says attackers exploited it to compromise nearly 1,000 devices worldwide and steal configuration files and credentials.

- Type: Early warning
- Kind: Vulnerability
- Vendor: Zyxel
- Product: GS1900
- Status: Reported, not confirmed
- Sources: 8 distinct
- First seen: 2026-11-04 20:08 UTC

> No statement or filing from Zyxel has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## What to do

- Install the patched firmware on all GS1900 series switches now.
- Check switch logs and configurations for unexpected changes or unknown accounts.
- Change any credentials that were stored on or used with affected switches.
- Restrict management interface access to trusted networks only.

## Timeline

- 2026-11-04 01:41 UTC: Made public by Mastodon
- 2026-11-04 20:08 UTC: First seen by cve.now
- 2026-11-05 01:52 UTC: Record last updated

## Evidence (8 sources)

- 2026-11-04 · Social · [Mastodon](https://infosec.exchange/@DailyCyberSecurity/117555625148858935): “Zyxel GS1900 zero-day CVE-2026-107441 was exploited in the wild and bypasses the CVE-2026-7273 patch.” (+2 more: [Mastodon](https://infosec.exchange/@ssvc/117559074706356767), [Mastodon](https://infosec.exchange/@cyberseckyle/117560829726928231))
- 2026-11-04 · Social · [Mastodon](https://social.raytec.co/@techbot/117558300931189363): “A flaw in Zyxel GS1900 switches was already being used by hackers, and the patch meant to fix it did not work.”
- 2026-11-04 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/): “Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzjameegdc2r))
- 2026-11-04 · Social · [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzjbks3tt72d): “A previously unknown zero-day vulnerability in Zyxel GS1900 network switches has been exploited by cybercriminals to compromise nearly 1,000 devices across 48 countries.” (+3 more: [Bluesky](https://bsky.app/profile/infosec.skyfleet.blue/post/bcthx6yxhvkyf), [Bluesky](https://bsky.app/profile/hapsis.bsky.social/post/3mzjclvfrek2i), [Bluesky](https://bsky.app/profile/crustytldr.bsky.social/post/3mzjhjlrutw2i))
- 2026-11-04 · Social · [Mastodon](https://infosec.exchange/@security_crawler_carl/117560254931943998): “Zyxel has finally dropped the patch — which is the res scroll you desperately need right now.”
- 2026-11-04 · Social · [Mastodon](https://mastodon.social/@Analyst207/117560274687397441): “A zero-day flaw in Zyxel GS1900 network switches has been exploited in a massive hack, compromising 996 devices across 48 countries in a months-long intrusion campaign.”
- 2026-11-04 · Social · [Bluesky](https://bsky.app/profile/newssecia.bsky.social/post/3mzjeivw67y2e): “Zyxel GS1900: CVE-2026-107441 (OOB write, web admin) exploited as 0-day.”
- 2026-11-05 · Social · [Bluesky](https://bsky.app/profile/ebansu.bsky.social/post/3mzjqyunzf22y): “全世界で約1000台のデバイスが侵害されたという。”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-4f5cab3822&body=https%3A%2F%2Fcve.now%2FSZB-4f5cab3822%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-4f5cab3822

### Has Zyxel confirmed it?

Mastodon, Mastodon and BleepingComputer report it. No statement from Zyxel has reached cve.now yet.

Source: https://infosec.exchange/@DailyCyberSecurity/117555625148858935, https://social.raytec.co/@techbot/117558300931189363, https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/, https://bsky.app/profile/undercodenews.bsky.social/post/3mzjbks3tt72d, https://infosec.exchange/@security_crawler_carl/117560254931943998, https://mastodon.social/@Analyst207/117560274687397441, https://bsky.app/profile/newssecia.bsky.social/post/3mzjeivw67y2e, https://bsky.app/profile/ebansu.bsky.social/post/3mzjqyunzf22y

### What should Zyxel users do?

Install the patched firmware on all GS1900 series switches now. Check switch logs and configurations for unexpected changes or unknown accounts. Change any credentials that were stored on or used with affected switches. Restrict management interface access to trusted networks only.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-4f5cab3822
Site guide for agents: https://cve.now/llms.txt