Zyxel has fixed a serious vulnerability, CVE-2026-107441, in the web management interface of ten GS1900 series network switch models. The flaw lets an unauthenticated attacker with network access run operating system commands using specially crafted HTTP requests. Firmware updates were released on October 22, and the advisory was published on November 3.
According to BleepingComputer, GreyNoise observed a suspected Chinese-speaking group, tracked as Kapibala, exploiting the switches from mid-August, compromising 996 devices in 48 countries and stealing configuration files, hashed root credentials and network information. In September the attacks were attributed to a different flaw, CVE-2026-7273, which Zyxel had patched in June, and CISA added that flaw to its list of exploited vulnerabilities.
Researchers at Binarly later recovered the exploit itself and found that it worked against all the firmware versions patched in June, bypassing the checks that update had added. Zyxel confirmed the new flaw on October 11.
Network administrators with GS1900 switches should install the October 22 firmware even if they updated in June, and make sure the management interface is not exposed to the internet. It is still unclear whether the exploit was built specifically to bypass the earlier fix.