610/69 Friday, November 6, 2026
Cybersecurity company Binarly has disclosed that attacks affecting nearly 1,000 Zyxel GS1900 series switches were actually carried out using a newly disclosed zero-day vulnerability. Initial investigations had incorrectly attributed the activity to an older vulnerability for which patches were already available. As a result, network administrators who had applied the previously recommended updates could still have remained exposed to compromise and unauthorized control of affected devices without realizing it.
The newly identified vulnerability, tracked as CVE-2026-107441 and rated 8.8 in severity, is an out-of-bounds write flaw in a CGI program within the device firmware. The issue allows an unauthenticated attacker to send specially crafted HTTP requests and execute operating system commands on affected devices. Earlier reports attributed the attacks to a threat actor tracked as Red Heron, which deployed Jitterly and Sixzut malware while allegedly exploiting CVE-2026-7273. However, deeper analysis found that the attackers had instead shifted to a previously unknown zero-day vulnerability affecting 10 models in the Zyxel GS1900 series. Consequently, earlier security patches were not sufficient to prevent exploitation through this newly identified flaw.
Zyxel has acknowledged the issue and released security updates addressing the vulnerability. Users and network administrators operating affected switch models should immediately verify their devices and upgrade to the latest available firmware to close the vulnerability and reduce the risk of compromise. The incident also demonstrates that vulnerability assessment should not rely solely on software version numbers or previously installed patches. Organizations should maintain deeper security monitoring and continuously review network activity for abnormal behavior to identify and respond to evolving attack techniques in a timely manner.