CVE-2026-107441: Unauthenticated RCE on Zyxel GS1900-24E

CVE-2026-107441 is an out-of-bounds write vulnerability in the CGI program of the Zyxel GS1900-24E switch. An adjacent attacker without credentials can send a specially crafted HTTP request and achieve OS command execution. CVE-2026-107441 therefore exposes the device to complete compromise.

The CVSS score is 8.8, classified as HIGH, indicating a critical vulnerability for defenders. The flaw was disclosed on November 3, 2026, just two days ago. On X (Twitter), at least 20 posts have been recorded in the last 24 hours, with signals indicating active community attention. Available data does not confirm public exploit documentation, but the situation warrants continuous monitoring.

For IT managers and CISOs: immediately verify firmware version on all Zyxel GS1900-24E devices in your infrastructure. Check if versions through 2.90(AAHK.2)C0 are running: if so, update urgently to a patched version from Zyxel. In the meantime, implement strict network access controls to the device and monitor for anomalous traffic. Do not download tools from unofficial sources.