Zyxel patches a zero-day hiding behind an old fix
Summary
Zyxel has released a patch for a zero-day vulnerability, CVE-2026-107441, which was actively exploited to compromise nearly 1000 network switches across 48 countries. This flaw allowed unauthenticated attackers to execute OS commands and access sensitive network information. Researchers initially misattributed the attacks to a previously patched vulnerability, CVE-2026-7273.
IFF Assessment
This article details an actively exploited zero-day vulnerability that allowed attackers to gain unauthorized access to sensitive network device configurations and credentials, posing a direct threat to organizations.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: September 24, 2026. Known ransomware use: Unknown.
Defender Context
This incident highlights the critical importance of promptly patching network devices, even those that have received previous security updates, as new zero-day vulnerabilities can emerge. Defenders should monitor for indicators of compromise related to Zyxel GS1900 switches and ensure all devices are running the latest firmware to mitigate exploitation risks.