What happened
On November 5, 2026, new analysis showed that the GS1900 exploitation campaign previously attributed to CVE-2026-7273 actually relied on a separate flaw, CVE-2026-107441. The earlier 2.90 Patch 2 firmware was released in June 2026 for CVE-2026-7273. Binarly reported that the exploit remained effective against all ten firmware releases issued as the earlier fix, so organisations that closed the risk after installing 2.90 Patch 2 may still have been exposed. Zyxel describes CVE-2026-107441 as a LAN-based, unauthenticated out-of-bounds write in the GS1900 CGI program that can execute operating-system commands through a crafted HTTP request.
Reporting tied the campaign to the compromise of 996 GS1900 switches across 48 countries, with configuration files, hashed root credentials and network information collected. The campaign deployed JITTERLY and SIXZUT variants. Binarly-associated hunt artefacts include p1.981666[.]xyz:6443, p2.981666[.]xyz:8080, s2.981666[.]xyz:8082, s7.981666[.]xyz:443, the file path /tmp/info and unexpected busybox telnetd listening on TCP 2323.
Zyxel published the CVE-2026-107441 advisory on November 3, 2026 and listed model-specific 2.90 Patch 3 builds. Fixed firmware is GS1900-8 2.90(AAHH.3)C0; GS1900-8HP 2.90(AAHI.3)C0; GS1900-10HP 2.90(AAZI.3)C0; GS1900-16 2.90(AAHJ.3)C0; GS1900-24 2.90(AAHL.3)C0; GS1900-24E 2.90(AAHK.3)C0; GS1900-24EP 2.90(ABTO.3)C0; GS1900-24HPv2 2.90(ABTP.3)C0; GS1900-48 2.90(AAHN.3)C0; and GS1900-48HPv2 2.90(ABTQ.3)C0. Attribution posture: reporting links the activity to a suspected Chinese-speaking cluster associated with Red Heron, while Zyxel names no actor and definitive responsibility remains unresolved.
Why this matters now
This development changes a completed remediation decision. Organisations that installed the earlier 2.90 Patch 2 firmware for CVE-2026-7273 may have reasonably marked the exposure closed, yet the recovered exploit remained effective because it used CVE-2026-107441. The immediate task is not another generic patch campaign; it is to reopen prior closure records, verify the firmware running on each device and identify which switches were exposed while operators believed they were protected.
Managed switches occupy a privileged network position and store configurations, administrator credentials and topology information useful for follow-on access. The documented campaign collected precisely those assets. Even though Zyxel describes the attack vector as LAN-based, management interfaces may be reachable from guest networks, vendor paths, compromised endpoints or incorrectly exposed segments. A firmware update prevents the current exploit path but does not determine whether configurations and credentials were already taken.
The decision for security leaders
Reopen every CVE-2026-7273 remediation record covering GS1900 switches. Network owners must verify the running firmware directly on each device against Zyxel’s model-specific 2.90 Patch 3 table; purchasing records, intended versions and completed change tickets are not sufficient evidence. Prior Patch 2 deployment should trigger compromise review, not merely another update task.
Separate prevention from incident closure. After updating, rotate switch administrator credentials and any reused secrets, inspect configurations and management-plane changes, search the published infrastructure and host artefacts, and determine whether the management CGI was reachable from any untrusted segment during the exposure period. Escalate confirmed artefacts to incident response because configuration and root-credential theft can support follow-on access.
Evidence of closure
- Device inventory shows every affected model on its exact fixed build.
- Configuration review records no unexplained management-plane changes.
- Credential-rotation records cover switch administrators and reused secrets.
- Network review records no contacts with published campaign infrastructure.
The Security.io assessment
The material change is that the original patch decision did not address the exploit path used by the observed actor. This is a textbook case for separating patch status from compromise status and for validating remediations against recovered exploit behaviour rather than advisory labels alone. The strongest risk sits with organisations that installed Patch 2, marked the issue closed and retained flat or externally reachable management paths.
Zyxel’s advisory does not itself state active exploitation; the confirmed-active assessment rests on Binarly’s analysis of the recovered exploit and independent reporting of the documented campaign. The 996-device count establishes substantial activity but does not identify individual enterprises or prove every affected device ran Patch 2. Closure therefore requires exact firmware evidence plus local compromise assessment, not an assumption that the published victim count defines the enterprise’s exposure.
Questions for the morning meeting
- Did prior Patch 2 completion close tickets without compromise review?
- Can network teams verify firmware from devices rather than asset records?
- Where can guest, user or vendor networks reach switch management?
- Which credentials or configurations would enable follow-on access?