A recently patched vulnerability in Zyxel GS1900 series switches was exploited in the wild as a zero-day to hack almost 1,000 devices, cybersecurity firm Binarly reports.
The flaw is tracked as CVE-2026-107441 (CVSS score of 8.8) and is described as an out-of-bounds write issue in the CGI program of the Zyxel GS1900 series switch firmware.
According to Zyxel, an unauthenticated attacker could exploit the security defect via crafted HTTP requests to achieve OS command execution.
The vulnerability impacts 10 GS1900 switch models. Zyxel rolled out fixes for it on October 23 and published an advisory on November 3.
On the same day, Binarly warned that attackers had exploited CVE-2026-107441 in attacks previously attributed to a Chinese hacking group.
The previous report came from GreyNoise, which warned on September 21 that the hackers exploited CVE-2026-7273, a Zyxel bug patched in June, to compromise roughly 1,000 devices in August.
GreyNoise linked the attacks to Red Heron, a Chinese threat actor that Acronis caught targeting Gitea instances in a large-scale hacking campaign, and CISA added CVE-2026-7273 to its KEV catalog.
Now, Binarly says that the attackers did not target CVE-2026-7273. They deployed variants of the Jitterly and Sixzut malware analyzed by Acronis, but their exploit targeted a previously unknown vulnerability.
“Because the threat actor was exploiting a different vulnerability, and the patch for CVE-2026-7273 remained ineffective, this had no effect on protecting devices from being exploited by this threat actor,” the cybersecurity firm notes.
Binarly notified Zyxel of the findings on September 29, and the vendor confirmed the new vulnerability, now tracked as CVE-2026-107441, two weeks later.
“Cases such as this highlight the urgency for a more reliable way of checking vulnerabilities in software. Advisories and version numbers certainly help, but they cannot be blindly trusted. We truly believe the definitive way to assess whether software components contain vulnerabilities is by looking at their binary code,” the company notes.
Related: Barracuda ESG Authentication Bypass Flaw Opens Path to Root
Related: Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical
Related: Android’s November 2026 Updates Patch Over 200 Vulnerabilities
Related: Critical Node-RED Flaw Exploited in Attacks
