CISAAnalysisZyxel patches out-of-bounds write zero-day in GS1900 switches
What happened.Zyxel and cybersecurity agencies published an urgent advisory detailing an actively exploited out-of-bounds write zero-day vulnerability in GS1900 series smart managed switches.
Why it matters.Smart managed network switches direct local network traffic and enforce VLAN isolation across enterprise offices. When network switch web interfaces harbor unauthenticated remote command execution flaws, attackers gain root privileges without passing edge firewalls. Network engineers must flash Patch 3 firmware updates across all GS1900 switches immediately. Infrastructure teams should remove administrative management consoles from public internet routing and enforce dedicated management VLANs.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-107441 with a CVSS score of 8.8, an out-of-bounds write defect in the web management CGI interface permits unauthenticated remote code execution.
- Active in-the-wild exploitation: Threat intelligence revealed threat actors exploited the flaw to compromise nearly 1,000 switches across dozens of countries to harvest configuration records.
- Patch bypass context: The campaign evaded earlier June 2026 patches because the underlying vulnerable code path remained unaddressed in intermediate firmware releases.
- Remediation release: Zyxel published Patch 3 firmware updates across 10 switch models, urging operators to restrict administrative web consoles from public routing.