Zyxel patches zero day flaw exploited to hack 1000 network switches

Zyxel has patched a zero-day vulnerability in its GS1900 series network switches, BleepingComputer reported on November 4, 2026. Hackers actively exploited the flaw to compromise nearly 1,000 devices worldwide. The attackers stole configuration files and credentials from affected devices. [1]

The vulnerability is tracked as CVE-2026-107441 and stems from an out-of-bounds write flaw in the web management interface of the switches. BleepingComputer reported that an unauthenticated attacker with network access can execute operating system commands using specially crafted HTTP requests. The flaw affects ten GS1900 switch models. [1]

Zyxel is a global networking technology company based in Hsinchu, Taiwan, that serves small and medium-sized businesses, enterprises, and telecommunications providers. This incident follows previous hardware security fixes across the industry, such as when Arista Networks patched an actively exploited SQL injection zero-day flaw in VeloCloud Orchestrator, as FTMQ Security reported earlier. [3][4]

Zyxel has released software updates to address the security vulnerability. System administrators using affected GS1900 models should apply the official patches immediately to secure their web management interfaces against unauthorized command execution. [1]