Threat Pulse 62High
Zyxel zero-day CVE-2026-107441 used to hack nearly 1,000 switches; first patch failed to block it
Severity 7ActiveconfirmedWeb servers and gateways

Zyxel zero-day CVE-2026-107441 used to hack nearly 1,000 switches; first patch failed to block it

· 10 days ago · bleepingcomputer.com
Sourcesbleepingcomputer.comKrebs on SecurityThe Hacker NewsHelp Net Security
On X
@BleepinComputerverifiedNov 4, 20:58 UTC

Zyxel fixes zero-day exploited to hack nearly 1,000 network switches

Open on X
@TheHackersNewsverifiedNov 5, 07:08 UTC

⚠️ Zyxel's earlier security patch failed to block a working exploit. Researchers confirmed the exploit still allowed unauthenticated root command execution on GS1900 switches running Patch 2, provided the management interface was reachable. Zyxel has now rel

Open on X
@SecurityWeekverifiedNov 5, 10:57 UTC

Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day

Open on X
@PVynckierverifiedNov 8, 11:46 UTC

Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441) - Help Net Security

Open on X
Why this score

Plan rubric with caps (verified sweep, Nov 11)

Back to the board

Updated Nov 14, 03:49 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.