What happened
Active exploitation of a zero-day vulnerability has been confirmed in Zyxel Switch deployments. The flaw, tracked as CVE-2026-107441, involves an out-of-bounds write condition that can be exploited via crafted HTTP requests. Attackers exploiting this vulnerability have been able to execute OS commands on affected devices, potentially leading to unauthorised control of the system. Initial reports indicated that a patch had been released to address the issue. However, it has since been revealed that previous attribution to a patched flaw was inaccurate; in reality, attackers exploited the zero-day in the wild before any fix was publicly available. The vulnerability allows unauthenticated actors to leverage the HTTP interface, making it a high-severity threat with active and ongoing exploitation concerns. The severity of this flaw has been rated as high, with an NVD score of 8.8. The affected component is the Zyxel Switch, and due to the active exploitation, impacted organisations should prioritise mitigation efforts. The patch status indicates that a fix is now available, and applying this update is critical to reduce the risk of ongoing or future attacks. Readers are advised to consult the vendor’s advisory for the latest information on available fixed versions and to implement recommended controls promptly.
Who is affected
Organisations running Zyxel Switch deployments are affected by this vulnerability. The flaw impacts any affected installations that may be exposed to the internet or untrusted networks, where attacker control over crafted HTTP requests could be exploited. It is important to note that for successful exploitation, the attacker needs to be able to send crafted HTTP requests to the device, typically requiring network access to the management interface. As exploitation has been confirmed to be active, all affected deployments are at risk, especially those with publicly accessible management interfaces or insufficient network controls. The vulnerability’s high severity implicates a significant impact, including potential unauthorised command execution on affected systems.
Recommended actions
- Apply the available patch to all affected Zyxel Switch deployments to prevent further exploitation.
- Restrict network access to affected devices to trusted sources, particularly limiting access to management interfaces exposed to untrusted networks.
- Monitor network traffic for unusual HTTP requests that might resemble the crafted vectors used in the exploitation attempts.
