Zyxel GS1900 Vulnerability: Patch Zero-Day Exploited in the Wild

Zyxel GS1900 Vulnerability: What Happened

The Zyxel GS1900 vulnerability tracked as CVE-2026-107441 is being exploited in the wild. Zyxel's advisory AV26-1114, dated November 3, 2026, covers vulnerabilities in GS1900 series switches, APs, FWA7, and Security Routers. An update to the advisory says open-source reporting indicates CVE-2026-107441 is exploited in the wild.

BleepingComputer reports that Zyxel has patched a zero-day in its GS1900 series network switches and that attackers used it to compromise nearly 1,000 devices worldwide. The attackers stole configuration files and credentials from those devices.

A government advisory also encourages users and administrators to review the provided web links and apply any necessary updates as they become available. For you as an MSP owner, this is a reminder to treat network gear as part of your attack surface, not just as plumbing.

Timeline

• November 3, 2026Zyxel publishes security advisory AV26-1114 covering vulnerabilities in GS1900 series switches, APs, FWA7, and Security Routers.
• November 4, 2026BleepingComputer reports that Zyxel has patched a zero-day in GS1900 switches and that attackers exploited it to compromise nearly 1,000 devices worldwide.

Who Is Affected

Any environment running Zyxel GS1900 series switches, Zyxel APs, FWA7, or Security Routers is in scope. The advisory says multiple versions and models are affected, so assume nothing is safe until you check the exact model and firmware against AV26-1114.

BleepingComputer says the reported exploitation hit nearly 1,000 network switches worldwide. That means this is not a theoretical concern. It's an active problem for devices that may be sitting in your clients' server rooms or wiring closets.

You also care if you use these devices inside your own delivery tooling. A compromised switch can expose credentials and configuration data that you use to manage client networks.

Keep in mind that affected can mean more than the device itself. If an attacker has credentials from a switch, they may be able to reach other parts of the network that trust that device. That's why the response should include credential rotation and log review, not just patching.

Why This Matters for MSPs

Network switches are easy to overlook because they do their job quietly. But they sit in the path of every conversation between users, servers, and the internet. In general, a device with that much visibility is a high-value target for attackers.

The reported theft of configuration files and credentials matters for MSPs because credentials tend to get reused. As a standing practice, treat switch management credentials like domain admin credentials. Patch firmware on a schedule, rotate credentials after any suspected exposure, and limit management access to trusted networks or VPNs.

From a business standpoint, this type of issue is also a client conversation. If a patch is not available yet, your client needs to know what you're watching and when you'll act. A short, factual update now is easier than a longer incident postmortem later.

Another reason to pay attention is that network switches are often managed with older firmware. Many MSPs inherit them from previous IT providers or from clients who bought them years ago. In general, a device that has not been patched in a long time is more likely to be vulnerable, so use this advisory as a prompt to review your patching process across the whole fleet.

Technical Details

Advisory: AV26-1114. CVE: CVE-2026-107441. Affected products: Zyxel GS1900 series switches, Zyxel APs, FWA7, and Security Routers. Versions: multiple versions and models.

An update to the advisory says open-source reporting indicates CVE-2026-107441 is exploited in the wild.

What to Do This Week

Work through this list in order. It covers client devices and any Zyxel gear you run internally.

1. Inventory every Zyxel GS1900 series switch, AP, FWA7, and Security Router in your stack, including devices at client sites.
2. Check Zyxel advisory AV26-1114 and compare your exact model and firmware version against the affected products.
3. Apply the patch Zyxel has released for GS1900 switches, and apply updates for the other product lines as they become available.
4. Rotate credentials for any device that may be affected, because reported attacks stole configuration files and credentials.
5. Review logs for unauthorized management access, especially on devices that are reachable from the internet.
6. Restrict management interfaces to trusted networks or VPNs as a standing practice.
7. After patching, verify the firmware version on each device and record it in your documentation.
8. Send your clients a short factual update about what you're doing and when you expect to finish.

What to Tell Clients

Zyxel has published advisory AV26-1114 for vulnerabilities in GS1900 series switches, APs, FWA7, and Security Routers. One of the vulnerabilities, CVE-2026-107441, is being exploited in the wild. We're checking all affected devices now and will apply patches as Zyxel makes them available.

Reported attacks on GS1900 switches included theft of configuration files and credentials. Because of that, we're rotating credentials on and for any device that may be affected. We'll confirm that work with you.

If you have one of these Zyxel devices, you don't need to take action on it yourself. We'll handle the firmware check and the patching, and we'll tell you if we need anything from you.

Frequently Asked Questions

Sources

• Zyxel fixes zero-day exploited to hack nearly 1,000 network switchesBleepingcomputer · Reported