Are your Zyxel GS1900 switches exposed to CVE-2026-107441?
Zyxel's 3 November 2026 advisory for CVE-2026-107441 describes an out-of-bounds write in the CGI program of GS1900 firmware. A LAN-based, unauthenticated attacker could potentially execute OS commands via a crafted HTTP request. The official CVE record, from Zyxel as CNA, scores it CVSS 3.1 8.8 High. Update each listed model to the 2.90(.3)C0 firmware in Zyxel's table. It is not in CISA KEV.
High (CVSS 8.8). Not in CISA KEV. A .2 build is not the fix
Zyxel's official advisory (initial release 3 November 2026) tells users to install the patches in its table. The official CVE record scores it CVSS 3.1 8.8 High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CVE-2026-107441 was not in CISA's Known Exploited Vulnerabilities catalogue when we checked at 22:27 GMT on 10 November 2026 (catalogue 2026.11.10). Do not confuse it with CVE-2026-7273, an older GS1900 issue that is in KEV; a 2.90(.2)C0 build that fixed 7273 is not the fix for 107441. The official advisory does not mention exploitation.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 10 November 2026, 22:41 GMT.
At a Glance
Based on Zyxel's official advisory, the official CVE record, and CISA KEV catalogue 2026.11.10, rechecked at 22:27 GMT on 10 November 2026. Last updated 10 November 2026, 22:41 GMT.
High, CVSS 3.1 8.8
Zyxel as CNA, in the official CVE record: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base severity High. The advisory page itself does not list a score.
Not in CISA KEV
Not listed in catalogue 2026.11.10 when checked at 22:27 GMT on 10 November 2026. The official advisory does not mention exploitation. Do not confuse this CVE with KEV-listed CVE-2026-7273.
Ten GS1900 models in the table
Zyxel: 2.90(.2)C0 and earlier on the listed models. On-market products not listed in the table remain unaffected. End-of-support models are unknown in our checker.
2.90(.3)C0 for each listed model
Follow Zyxel's table exactly. A .2 build is not this fix.
Zyxel publishes the official advisory for CVE-2026-107441 (revision history: 2026-11-3, initial release) and lists the ten models and 2.90(.3)C0 patches. The official CVE record is published the same day.
CVE-2026-107441 is still not in CISA KEV catalogue 2026.11.10. Older GS1900 CVE-2026-7273 remains in KEV; a .2 build that fixed 7273 is not safe for 107441.
Inventory every GS1900, apply the exact .3 firmware for each listed model, and do not expose the management interface to untrusted LANs.
Affected models and patched firmware (Zyxel advisory)
This table follows Zyxel's official advisory exactly. Zyxel says that after investigation it identified the vulnerable firmware and released patches for models still within their vulnerability support period, and that on-market products not listed in the table remain unaffected. Credited to security researchers; we do not name them.
| Affected model | Affected version | Patch availability |
|---|---|---|
| GS1900-8 | 2.90(AAHH.2)C0 and earlier | 2.90(AAHH.3)C0 |
| GS1900-8HP | 2.90(AAHI.2)C0 and earlier | 2.90(AAHI.3)C0 |
| GS1900-10HP | 2.90(AAZI.2)C0 and earlier | 2.90(AAZI.3)C0 |
| GS1900-16 | 2.90(AAHJ.2)C0 and earlier | 2.90(AAHJ.3)C0 |
| GS1900-24 | 2.90(AAHL.2)C0 and earlier | 2.90(AAHL.3)C0 |
| GS1900-24E | 2.90(AAHK.2)C0 and earlier | 2.90(AAHK.3)C0 |
| GS1900-24EP | 2.90(ABTO.2)C0 and earlier | 2.90(ABTO.3)C0 |
| GS1900-24HPv2 | 2.90(ABTP.2)C0 and earlier | 2.90(ABTP.3)C0 |
| GS1900-48 | 2.90(AAHN.2)C0 and earlier | 2.90(AAHN.3)C0 |
| GS1900-48HPv2 | 2.90(ABTQ.2)C0 and earlier | 2.90(ABTQ.3)C0 |
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Vendor steps and our advice are labelled separately.
Apply the .3 firmware
- Zyxel: install the 2.90(.3)C0 firmware listed for each affected model in the official advisory table.
- Our advice: inventory every GS1900 by model and firmware. A 2.90(.2)C0 build is not the fix for this CVE.
- Our advice: treat models not in the table with care: Zyxel says on-market products not listed are unaffected; end-of-support models are UNKNOWN in our checker.
- Our advice: keep GS1900 management interfaces off untrusted networks. This flaw is LAN-based and needs no account.
Hunt and contain
- Our advice: Zyxel has published no indicators of compromise. Look for unexpected admin logins and configuration changes on the switch.
- Our advice: look for unexpected reboots, and for unexpected outbound connections from the switch.
- Our advice: look for unexpected management access to the web interface from unusual internal addresses.
- Our advice: if you find signs of misuse, isolate the switch, keep its logs and a saved config, apply the .3 firmware, and rotate admin credentials.
Proactive: Vendor Steps, Then Ours
Zyxel's official advisory first. CybaVerse advice is labelled separately.
Install the .3 firmware for each listed model
Follow Zyxel's official advisory table exactly. Each listed model has its own 2.90(xxxx.3)C0 image. Do not assume a .2 build, including one that addressed CVE-2026-7273, is sufficient.
Inventory model and firmware
Record every GS1900 you or your clients run, including older or end-of-support units. Use the pack checker against an inventory CSV. Models not in Zyxel's table are UNKNOWN in the checker. On-market products not listed are, in Zyxel's words, unaffected.
Reduce LAN exposure
The official description is a LAN-based, unauthenticated attacker and a crafted HTTP request. Keep the management interface off untrusted or guest LANs, and restrict which hosts can reach the web UI, in addition to applying the firmware.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check exposure offline and hunt for signs of misuse. Everything is read-only.
check-zyxel-gs1900.sh
Read-only offline checker. It compares a model and firmware string, or an inventory CSV, with Zyxel's advisory table. A 2.90(.2)C0 build is treated as still vulnerable to CVE-2026-107441, even if it fixed the earlier CVE-2026-7273. Models not in Zyxel's table, including end-of-support units, are UNKNOWN. On-market products not listed are, per Zyxel, unaffected.
bash check-zyxel-gs1900.sh --model GS1900-24 --firmware '2.90(AAHL.2)C0'
bash check-zyxel-gs1900.sh --csv inventory.csv
bash check-zyxel-gs1900.sh --csv inventory.csv --syslog exported.logCheck-ZyxelGS1900.ps1
The same checks in PowerShell 7, with identical output and exit codes.
pwsh -File Check-ZyxelGS1900.ps1 -Csv inventory.csv -Syslog exported.logKQL and Sigma
6 KQL hunts for Microsoft Sentinel and Defender (Q1a and Q1b inventory and firmware; Q2 management access; Q3 admin logins; Q4 config changes; Q5 reboots; Q6 unexpected outbound traffic from the switch). 6 Sigma rules cover the same ground, with Kusto conversions included. None of the KQL has been run against a live tenant yet. Zyxel has published no indicators of compromise.
Verdicts
- PATCHED.3 or later, or a newer major version, for a model in Zyxel's table.
- LIKELY VULNERABLE.2 builds are flagged as patched for CVE-2026-7273 only, not for CVE-2026-107441. .1 and earlier are vulnerable to both.
- UNKNOWNModel not in Zyxel's table (including end-of-support models), firmware code that does not match the model, or no version parsed.
Exit codes
| Code | Meaning |
|---|---|
| 0 | All PATCHED |
| 1 | Any LIKELY VULNERABLE |
| 2 | Any UNKNOWN |
| 3 | Error |
Do not treat a .2 build that fixed CVE-2026-7273 as safe for CVE-2026-107441. The full pack zip contains 23 files.
What is in the pack
| File | What it does |
|---|---|
| check-zyxel-gs1900.sh | Offline checker for Linux and macOS (bash) |
| Check-ZyxelGS1900.ps1 | The same checker in PowerShell 7 |
| KQL (6 hunts) | Microsoft Sentinel and Defender hunts Q1a to Q6 |
| Sigma (6 rules) | Switch management, login, config, reboot and outbound rules, plus Kusto conversions |
| tests/ | Fixtures and tests |
| README.md | Verified facts, Zyxel vs our advice, limits and usage |
Reactive: How to Hunt (Our Advice)
Zyxel has published no indicators of compromise. The hunts below are CybaVerse advice. CybaOps can run them across your estate.
Admin logins and config changes
Review switch logs for unexpected admin logins and configuration changes (pack hunts Q3 and Q4).
Reboots and outbound traffic
Look for unexpected reboots (Q5) and unexpected outbound connections from the switch (Q6).
Management-path access
Look for unexpected internal hosts reaching the web management interface (Q2).
If you find signs of compromise (our advice)
- Isolate the switch from untrusted LANs and keep its logs and a saved configuration.
- Apply the exact 2.90(.3)C0 firmware for that model from Zyxel's table.
- Rotate the switch admin credentials, and review other devices that share those credentials or that the switch can reach.
- Start incident response if the switch sits in a path that can reach wider management or production networks.
Zyxel GS1900 CVE-2026-107441 FAQ
Short answers based on Zyxel's official advisory and the official CVE record, rechecked on 10 November 2026.
What is CVE-2026-107441?
Zyxel's official advisory is titled as an out-of-bounds write vulnerability in GS1900 series switches. Zyxel says the flaw in the CGI program of GS1900 firmware could allow a LAN-based, unauthenticated attacker to exploit it and potentially execute OS commands via a crafted HTTP request. Initial release: 3 November 2026. Credited to security researchers; we do not name them.
How severe is it?
The official CVE record, with Zyxel as CNA, lists CVSS 3.1 8.8 High, vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The advisory page itself does not print a CVSS score. We use the official CVE record for the score, and we label it High as that record does.
Is it in CISA KEV, and is it exploited?
CVE-2026-107441 was not in CISA KEV when we checked at 22:27 GMT on 10 November 2026 (catalogue 2026.11.10). The official Zyxel advisory does not mention exploitation. Do not confuse this CVE with CVE-2026-7273, an older GS1900 issue that is in KEV. A 2.90(.2)C0 build that fixed 7273 is not the fix for 107441.
Which models and versions are affected?
Follow Zyxel's table: GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48 and 48HPv2, each at 2.90(xxxx.2)C0 and earlier, fixed in 2.90(xxxx.3)C0. Zyxel says on-market products not listed in the table remain unaffected. End-of-support models are not in the table; our checker reports them UNKNOWN.
What is Zyxel's official advice?
Install the patches listed for models still within their vulnerability support period, as shown in the advisory table.
Who is this relevant to?
Organisations and MSPs that run Zyxel GS1900 access switches, especially any unit whose web management interface is reachable from a LAN that is not fully trusted.
Protect Your Network Edge, and Your Customers'
CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches (initial release 3 November 2026)
- CVE record: CVE-2026-107441 (CNA: Zyxel; CVSS 3.1 8.8 High)
- CISA: Known Exploited Vulnerabilities catalogue (CVE-2026-107441 was not listed when checked 10 November 2026, 22:27 GMT, catalogue 2026.11.10)
Related threat guides: Chrome CVE-2026-125350 and N-able N-central 2026.4 HF2. All threat guides.