Affected Systems
Zyxel GS1900 series network switches (all ten models). CVE-2026-107441: out-of-bounds write in web management interface. Exploited from mid-August 2026; patched October 22, 2026. Affects devices even if previously patched for CVE-2026-7273.
Exploitation Status
Active exploitation confirmed. Kapibala threat actor (suspected Chinese-speaking, linked to Red Heron campaign) compromised 996 devices across 48 countries starting August 17, 2026. Exploit code recovered from attacker infrastructure by Binarly. Exploitation continued through at least late September on patched systems.
Business Impact
Unauthenticated remote code execution via HTTP requests to web management interface. Attackers stole device configuration files, hashed root credentials, and network information from compromised switches. High risk for lateral movement and credential abuse. Initially misidentified as CVE-2026-7273, delaying correct remediation. Organizations that patched in June remained vulnerable until October 22 update.
Urgency
🔴 Immediate
Recommended Actions
- Immediately update all Zyxel GS1900 switches to firmware released October 22, 2026 or later to patch CVE-2026-107441
- Audit GS1900 switches for indicators of compromise: unexpected configuration changes, unauthorized access logs, or anomalous outbound connections between August 17 and present
- Reset credentials on all GS1900 switches and downstream systems accessible from compromised devices, as root credentials were exfiltrated
- Restrict network access to switch management interfaces using ACLs or VLANs; disable web management from untrusted networks if feasible
- Review firewall and SIEM logs for HTTP requests to GS1900 management IPs from external or unexpected internal sources since mid-August 2026