Zyxel closes the CVE-2026-107441 zero-day that its June patch never fixed on GS1900 switches

On November 3, 2026, Zyxel published the advisory for zero-day CVE-2026-107441, an out-of-bounds write in the web interface of its GS1900 switches already exploited against nearly 1,000 devices. Administrators must move to firmware 2.90 Patch 3 and hunt for any compromise the misattributed June fix may have masked.