Zyxel patches zero-day exploited in attacks on nearly 1,000 GS1900 series network switches
Vulnerability allowed unauthenticated attackers to compromise devices and exfiltrate configuration files and credentials
Key Takeaways
- Zyxel has patched a zero-day vulnerability in GS1900 series network switches that was exploited in the wild.
- Nearly 1,000 devices were compromised globally, with configuration files and credentials stolen.
- Exploitation occurred before the patch was released, highlighting the need for timely updates.
- Affected users should update to the latest firmware to mitigate the risk of further compromise.
Quick answers
- What happened?
- Zyxel has released firmware updates to address a zero-day vulnerability in its GS1900 series unmanaged and smart managed network switches. Security reports indicate that threat actors exploited the flaw in the wild prior to patching, compromising nearly 1,000 devices globally and gaining access to configuration files and credentials.
- Which products are affected?
- GS1900 series network switches
- What should defenders do?
- Zyxel has released firmware patches addressing the zero-day vulnerability. Affected users are strongly advised to update their GS1900 series switches to the latest available firmware immediately. Until patches are applied, network segmentation and monitoring for unusual switch behavior are recommended.
Zyxel has addressed a zero-day vulnerability affecting its GS1900 series network switches that was exploited in the wild to compromise approximately 1,000 devices worldwide. According to reporting, the flaw was used by unauthenticated attackers to gain access to affected switches, from which configuration files and credentials were stolen. The exploitation occurred before Zyxel released patches, prompting the company to urge users to update their firmware immediately. The full details of the exploit method have not been publicly disclosed, but the scale of compromise — nearly 1,000 devices across multiple regions — underscores the severity of the issue. Zyxel's advisory confirms that the vulnerability affects GS1900 series switches and that the patches address the flaw that was actively exploited. Security researchers note that compromised switches could allow lateral movement into connected networks, making prompt patching critical for affected organizations.
Security Details
The vulnerability affects Zyxel GS1900 series network switches and was exploited in the wild prior to the release of firmware patches. Successful exploitation allowed unauthenticated attackers to access and exfiltrate configuration files and credentials from compromised devices. The full exploit chain details have not been publicly disclosed, but the impact includes potential lateral movement into connected networks.
Affected products
GS1900 series network switches
Mitigation
Zyxel has released firmware patches addressing the zero-day vulnerability. Affected users are strongly advised to update their GS1900 series switches to the latest available firmware immediately. Until patches are applied, network segmentation and monitoring for unusual switch behavior are recommended.
Sources
BleepingComputer
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Nov 4, 2026 · 20:58
Original link
Related Security News
Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware
According to ESET researchers, a Russia-aligned threat actor known as Gorbag has been conducting cyber espionage campaigns against Ukrainian entities since at least February 2025. The attacks leverage a vulnerability in WinRAR to deliver simple information stealer malware, with a focused preference for law enforcement, justice, local administration, and defense sector targets near the front lines.
CISA Adds Two Ivanti Connect Secure Vulnerabilities to Known Exploited Catalog
The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on October 30, 2026, based on evidence of active exploitation. Both affect Ivanti Connect Secure and are subject to remediation requirements under Binding Operational Directive 26-04 for federal agencies.
