On November 3, 2026, Zyxel published an advisory for CVE-2026-107441 affecting ten GS1900 Ethernet switches. For small businesses that already hired a provider to update these devices over the summer, the key distinction is practical: work on the earlier vulnerability does not prove that today’s switch is fixed.
Check a new advisory reference
Zyxel describes an out-of-bounds write in the program handling web management requests. An attacker without credentials, with the network access described by the vendor, could execute operating-system commands. Binarly identified that the investigated exploit still worked on firmware released for CVE-2026-7273. The newer finding has a separate advisory and new fixed releases.
What the compromised-device count means
BleepingComputer traces how the exploit attribution changed from the older flaw to the new one. The total of 996 switches in 48 countries comes from GreyNoise’s campaign investigation. P. K. Sharma’s independent comparison identifies a limit: the count does not show how many victims were running June firmware. It should not be presented as evidence that every previously patched device was compromised.
Compare complete model and build identifiers
Ask for the exact model and installed build. For the GS1900-24, for example, Zyxel lists 2.90(AAHL.3)C0 as fixed and 2.90(AAHL.2)C0 and earlier as affected. Other models have different identifiers. Confirm the version after restarting and retain the result in maintenance records; an unqualified “up to date” is insufficient evidence.
Review management access
Alongside updating, check which networks can reach the GS1900 web interface. Restrict administration to authorized devices and management networks. If evidence suggests intrusion, have the configuration and potentially exposed secrets examined. Password rotation alone cannot block an exploit that works before authentication.
How Soclyde relates
Managing switches involves locating administrative credentials and avoiding reuse across sites or customers. Soclyde organizes these records in an encrypted vault held on devices, with access sharing in Premium. It does not patch Zyxel firmware or replace analysis of a compromised switch.
What to remember
Reopen GS1900 maintenance records even when an update was completed in June. Verify November’s fixed builds, management reachability and any intrusion evidence. To organize provider and team credentials, contact Soclyde.
