THE CRUNCH
The August attacks that compromised almost 1,000 Zyxel GS1900 series switches did not exploit the flaw they were blamed on, according to cybersecurity firm Binarly. GreyNoise had attributed the intrusions to CVE-2026-7273, a Zyxel bug patched in June, and linked them to Red Heron, a Chinese threat actor. Binarly's analysis found the attackers instead used a previously unknown vulnerability, meaning the June patch had no effect on protecting the affected devices.
The newly confirmed flaw is tracked as CVE-2026-107441 and scored 8.8 on the CVSS scale. It is an out-of-bounds write issue in the CGI program of the GS1900 firmware, and Zyxel says an unauthenticated attacker could trigger it with crafted HTTP requests to run operating system commands. Ten GS1900 switch models are affected.
Zyxel released fixes on October 23 and published an advisory on November 3. Binarly had notified the vendor on September 29, and Zyxel confirmed the new vulnerability two weeks later. The attackers deployed variants of the Jitterly and Sixzut malware previously analysed by Acronis.
"Because the threat actor was exploiting a different vulnerability, and the patch for CVE-2026-7273 remained ineffective, this had no effect on protecting devices from being exploited by this threat actor," Binarly noted, arguing that advisories and version numbers cannot be blindly trusted when checking whether software is vulnerable.