CVE-2026-107441Zyxel GS1900-24E firmware

In the news, but not on CISA's list of exploited flaws yet. Treat it as urgent if you run it.

Chance of exploitation in 30 daysEPSS

0.29%

0%Higher than 22% of all CVEs

Exploited in the wild: Not confirmedBy CISA
Severity: 8.8 of 10High, CVSS
Used in ransomware: Not known
US federal deadline: None set

Reading the vendor advisory

Fix it in one click

Fix it in your code

Claude Code Codex Cursor Claude Code (web)

Explain it to me

Claude ChatGPT

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-107441. Nothing runs until you send it.

About this flaw

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Published: 3 Nov 2026
Weakness: CWE-787

What should I do about this?

Advisories and references

zyxel.comzyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026