What Happened
A Zyxel GS1900 vulnerability is being exploited in the wild. Zyxel has patched the zero-day after hackers used it to compromise nearly 1,000 network switches worldwide and steal configuration files and credentials, according to BleepingComputer. Zyxel's advisory AV26-1114, dated November 3, 2026, also covers APs, FWA7, and Security Routers. If you manage any of these devices for clients, act now.
The cost to an MSP is direct: a compromised switch can expose client credentials, give attackers a foothold in the network, and force emergency after-hours work. Start by identifying every affected Zyxel device in your client base and patching it.
Network switches are an attractive target because they sit at the center of a client's infrastructure. A single compromised switch can give an attacker visibility into traffic, access to management credentials, and a stable foothold for lateral movement. For an MSP, the cost includes incident response, lost trust, and the risk of repeat attacks if the root cause is not fully cleaned.
Timeline
- November 3, 2026: Zyxel publishes security advisory AV26-1114 covering vulnerabilities in GS1900 series switches, APs, FWA7, and Security Routers.
- November 4, 2026: BleepingComputer reports that Zyxel patched a zero-day in GS1900 switches that was exploited to compromise nearly 1,000 devices and steal configuration files and credentials.
Who Is Affected
Zyxel advisory AV26-1114 lists GS1900 series switches, multiple versions and models, and Zyxel APs, FWA7, and Security Routers, multiple versions and models, as affected. The reported exploitation targeted GS1900 switches, with nearly 1,000 devices compromised worldwide, according to BleepingComputer.
Any MSP that manages these devices for clients is in scope. Attackers can use a compromised switch to move laterally, intercept traffic, or hold the network for ransom. Even if a client device is not directly exposed, it can still be a pivot point.
The advisory does not list specific firmware versions, which means you should check every device in the affected product families. If you are not sure whether a device is vulnerable, treat it as vulnerable until you have confirmed the patch status.
Technical Details
CVE-2026-107441 is the vulnerability in Zyxel GS1900 series network switches that open-source reporting indicates is exploited in the wild. Zyxel advisory AV26-1114 also lists vulnerabilities affecting Zyxel APs, FWA7, and Security Routers, across multiple versions and models. BleepingComputer reports that attackers exploited the GS1900 flaw to steal configuration files and credentials, and that Zyxel has patched the zero-day.
The sources do not describe the attack vector or name specific affected versions beyond the product families listed in the advisory. In general, network device vulnerabilities are often exploited without user interaction, which is why patching is urgent.
Zyxel GS1900 Vulnerability Risk
For an MSP, the real cost of a Zyxel GS1900 vulnerability is the recovery work after an attack. Stolen credentials can unlock other systems. A compromised switch can disrupt an entire client site, and the pressure to restore service falls on you.
Patch management is the standing defense. Keep an inventory of every network device you manage, know which firmware versions are running, and apply vendor updates as soon as they are available. In this case, the patch exists, so the window to act is now.
As a standing practice, segment management interfaces from user networks, enforce strong authentication for device administration, and back up device configurations regularly. These steps reduce the blast radius when a vulnerability like this is exploited.
What MSPs Should Do
Treat this as a confirmed, exploited vulnerability. Patch and check for signs of compromise immediately. Do not wait for a client to call you about a problem.
- Review Zyxel security advisory AV26-1114 and the links it provides for patch details and affected models.
- Identify every GS1900 switch, AP, FWA7, and Security Router in your client environments and apply the available updates.
- Rotate any credentials stored on or accessible from affected devices, since configuration files and credentials were stolen in the reported attacks.
- Check device logs and configurations for unauthorized changes, especially admin accounts and remote access settings.
- Monitor your clients' networks for suspicious traffic from these devices and plan for replacement if a device cannot be patched.
- Keep an eye on Zyxel's advisory for updates, as more affected versions or additional guidance may be published.
How EnterProtect Helps
EnterProtect backup keeps clean restorable copies of your clients' systems, so you can recover a device or network segment even after an attacker has tampered with it.
EnterProtect recovery gets a client running again after an outage, reducing the time between incident and return to normal.
EnterProtect vulnerability scanning finds exposed versions across your clients' networks, giving you a clearer picture of what needs patching.
The goal is to make recovery boring. When a client is down, you want a tested path back to a known good state. EnterProtect is built to support that workflow.
Frequently Asked Questions
Is the Zyxel GS1900 Vulnerability Being Exploited in the Wild?
Yes. Open-source reporting indicates that CVE-2026-107441 is exploited in the wild. BleepingComputer reports that hackers used it to compromise nearly 1,000 switches worldwide and steal configuration files and credentials.
Which Zyxel Products Are Affected?
Zyxel advisory AV26-1114 lists GS1900 series switches, APs, FWA7, and Security Routers, in multiple versions and models. The reported exploitation targeted GS1900 switches specifically.
What Did the Attackers Steal in the Zyxel GS1900 Attacks?
According to BleepingComputer, the attackers stole configuration files and credentials from compromised GS1900 switches. Treat any credentials stored on those devices as exposed and rotate them.
What Should I Do If I Manage Affected Zyxel Devices for Clients?
Review advisory AV26-1114, apply the available updates, rotate potentially exposed credentials, and check device logs for signs of compromise. Also monitor your clients' networks for unusual traffic from these devices.
Can a Compromised Zyxel Switch Be Recovered?
Yes, in many cases. Apply the vendor patch, restore the device configuration from a clean backup, and then rotate all credentials that may have been exposed. Recovery is faster when you have a tested backup process in place. This is why regular configuration backups are a core part of an MSP's recovery toolkit.
Sources
- Zyxel fixes zero-day exploited to hack nearly 1,000 network switches (Bleepingcomputer)