A newly disclosed Zyxel switch vulnerability, CVE-2026-107441, lets someone on your network run commands on a GS1900 series switch with no login at all, even on devices that already installed Zyxel’s earlier patch. Zyxel published the actual fix on November 3, 2026, but by then nearly 1,000 of these switches were already compromised around the world, according to Help Net Security. If your office IT closet has a Zyxel GS1900 switch, check its firmware version this week.
- CVE-2026-107441 hits the Zyxel GS1900 line: models 8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48, and 48HPv2.
- Zyxel’s June 2026 patch for a related bug (CVE-2026-7273) didn’t close this hole. The real fix is the 2.90 Patch 3 firmware branch, with a specific build for each model.
- No password is required. An attacker already on your local network can send a crafted web request to the switch’s management interface and potentially run operating system commands.
- GreyNoise researchers had already tracked close to 1,000 compromised GS1900 switches across 48 countries tied to this exploit chain.
- Check your switch’s exact firmware version against Zyxel’s advisory this week. A patch you installed in June doesn’t mean you’re covered now.
What is CVE-2026-107441 and which switches does it affect?
CVE-2026-107441 is an out-of-bounds write bug in the web management code of Zyxel’s GS1900 series switches, the small managed switches a lot of Southwest Florida offices use to run their wired network and power VoIP phones or access points over PoE. Zyxel’s November 3, 2026 advisory names the GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48, and 48HPv2 as affected, and lists an exact patched firmware build for each model. Security researcher Yegor Vasilenko of Binarly is credited with finding the flaw.
Why didn’t Zyxel’s earlier patch fix this?
Zyxel patched a related stack buffer overflow, CVE-2026-7273, in June 2026. That fix touched the same CGI script, but as Help Net Security reported on November 5, 2026, it didn’t close the path attackers were actually using. The exploit kept working on “patched” switches for months. A vendor advisory saying a CVE is fixed doesn’t always mean every way into that code is closed. Check the specific firmware build number against the current advisory, not just whether you clicked update at some point this year.
How could someone actually exploit this on my network?
The bug is pre-authentication and limited to the local network. An attacker doesn’t need your switch’s admin password. They need a foothold somewhere on your network first, a compromised laptop, an open guest port, a device plugged into an unused jack in a conference room, and from there they can send a crafted request to the switch’s management interface and potentially run commands on it. That’s one more reason to keep guest and visitor network traffic separated from the switches, phones, and servers that run your business; we covered setting that up properly in our piece on zero trust guest WiFi.
What should a Southwest Florida small business do about it?
Start by finding out what’s actually sitting in your network closet. Most small offices run on whatever switch a previous IT person or a big-box store sold them, and nobody has checked the make, model, or firmware since install day. Pull up the switch’s web interface, check the model and firmware against Zyxel’s advisory, and apply the 2.90 Patch 3 branch for your model if you’re behind. If you don’t manage your own network gear, ask whoever does, in writing, whether they’ve checked this.
This is the same pattern we’ve seen with other network-edge hardware this year. We covered a similar situation with a FortiMail vulnerability and with the Check Point firewall flaw: a device that’s “patched” on paper can still have an open door, and most businesses only find out when something breaks.
Why does a switch vulnerability matter for a small business?
A compromised switch sits in the middle of your network, not at the edge like a firewall, so an attacker who gets onto it can see and potentially intercept or redirect traffic between every device plugged into it: computers, phones, printers, security cameras, point-of-sale terminals. Southwest Florida has a lot of small offices, medical practices, and retail locations running exactly this kind of switch, often installed years ago and never checked again. A $200 piece of network hardware from 2022 can end up being the weakest link in a business that otherwise spent real money on firewalls and endpoint protection.
Frequently asked questions
Do I need to replace my Zyxel switch, or is a firmware update enough?
A firmware update to the 2.90 Patch 3 branch, with the specific build listed for your model, is what Zyxel’s advisory calls for. You don’t need to replace the hardware because of this flaw specifically, but if the switch is old enough that it no longer receives security updates at all, that’s a separate conversation worth having.
How do I find my switch’s model and firmware version?
Log into the switch’s web management interface, usually by typing its IP address into a browser on the same network, and look for a system or device information page. The model number is also printed on a label on the switch itself.
What if I’m not sure whether my network has already been affected?
Check your switch logs for unusual admin logins or configuration changes you don’t recognize, and have someone review them who knows what normal activity looks like. Guessing isn’t a security plan.
Does this affect home routers or just business switches?
No. This advisory is specific to Zyxel’s GS1900 series, which are managed switches built for business networks, not Zyxel’s consumer home routers.
If you don’t know the model and firmware version of every switch on your network right now, that’s worth fixing before the next advisory comes out, not after. SWFIT offers a free 15-minute network security review for Southwest Florida businesses who want a second set of eyes on what’s actually plugged into their network closet. Reach out through our contact page to get on the calendar.
