Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day

A vulnerability in Zyxel switches was exploited, despite initial blame on a previously patched flaw. The actual exploited flaw is an out-of-bounds write issue that allows attackers to execute operating system commands by sending specially crafted HTTP requests. This vulnerability is tracked as CVE-2026-107441. The flaw was previously unknown, making it a zero-day vulnerability. Attackers can use this flaw to gain unauthorized access to the switches. The vulnerability was misattributed to a patched flaw initially.