Act today Critical Known exploited Patch available
Patched Zyxel GS1900 switches still open to exploit used in attacks
Help Net SecurityZyxelCVE-2026-107441, CVE-2026-7273
What happened. Binarly found that Zyxel GS1900 switches fixed for CVE-2026-7273 are still open to an exploit used in the wild. The exploit relies on a different flaw, CVE-2026-107441, which the patch did not fix. CISA lists CVE-2026-7273 as known exploited.
Who is affected. Owners of Zyxel GS1900 series switches. Sites using these switches in network paths to plant systems may be exposed. The source gives no version list.
What to do. Check whether you run Zyxel GS1900 switches, including patched ones, and watch for a Zyxel fix for CVE-2026-107441. Restrict management access to them meanwhile.
When to act. Act today: on CISA's list of known exploited flaws
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L3.5
- L3
Why: Network switches carry traffic between plant and business networks, so they sit in site operations or the industrial DMZ, and a root-level flaw could give attackers a path inward.
- Are you exposed?
Search the asset inventory for Zyxel GS1900 series switches and check whether their web management interface is reachable from untrusted networks.
- If you cannot fix it yet
- Restrict switch management and web (CGI) access to a small set of known administration hosts.
- Keep switch management interfaces off the internet and off the general IT network.
- Segment the switches behind a firewall until a fix for CVE-2026-107441 is available.
- Watch for
- Unexpected requests to the switch web management interface from unknown or IT-network hosts.
- Unexpected configuration changes, new accounts or reboots on GS1900 switches.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Help Net Security (opens helpnetsecurity.com)
More on Zyxel CVE-2026-107441 CVE-2026-7273