Attacks against Zyxel switches that were first blamed on a previously patched flaw have instead been tied to a zero-day vulnerability, according to SecurityWeek. The reattribution matters for defenders because a patch-based explanation can lead organizations to believe their devices are protected once updates are applied, when the exploited weakness may not have been addressed.
The vulnerability
The flaw is tracked as CVE-2026-107441 and is described as an out-of-bounds write vulnerability. According to the report, an attacker can exploit it by sending crafted HTTP requests to the affected device, which could allow execution of operating system commands on the switch.
Why the attribution changed
Earlier reporting connected the compromises to a patched issue. The later analysis found the activity was driven by a zero-day, meaning the vulnerability was being exploited before a fix was available. Organizations that relied on the earlier explanation may have treated their switches as remediated when they were still exposed during that window.
What security teams should do
- Verify whether Zyxel switches in your environment are reachable through management interfaces, especially from untrusted networks.
- Review HTTP access logs on affected devices for anomalous or malformed requests.
- Check for signs of unauthorized command execution or configuration changes on the switch.
- Monitor vendor advisories for official remediation guidance covering CVE-2026-107441.
Network infrastructure devices such as switches are often deployed with limited logging and monitoring, which can make compromises like this difficult to detect. Restricting management access and segmenting device administration networks remain practical measures while patch availability and deployment are confirmed.
