What happened. Zyxel published an advisory on Nov 3 for CVE-2026-107441 (CVSS 8.8), an out-of-bounds write in the web management interface of ten GS1900 switch models. A crafted HTTP request lets an attacker with network access run operating system commands without a login. Fixed firmware shipped Oct 22.
Why the June patch did not help. GreyNoise saw a suspected Chinese-speaking actor it calls Kapibala compromise 996 switches across 48 countries from around Aug 17, and first tied the attacks to CVE-2026-7273, which Zyxel patched in June and CISA added to its known-exploited list on Sept 21. Binarly then found the exploit checked for those patched firmware versions and bypassed the fix by corrupting a parameter counter before it was checked. The attackers took switch configs, hashed root passwords and network details.
What to do. Treat any GS1900 on the June firmware as still exposed. Upgrade to the Oct 22 builds, keep the management page on a separate admin network, and rotate any credentials stored in switch configs if the page was reachable.