New reporting indicates that recent attacks against Zyxel switches were not using the vulnerability initially suspected, but a different flaw tracked as CVE-2026-107441. According to the report, the issue is an out-of-bounds write vulnerability that could allow attackers to execute operating system commands through crafted HTTP requests.

For European businesses, this matters because it changes the risk picture: a device believed to be attacked through a previously patched weakness may instead have been exposed to a zero-day, meaning exploitation started before a fix was available. That affects how IT teams assess exposure, patching timelines and whether older assumptions about remediation were sufficient.

What happened

SecurityWeek reports that the Zyxel switch compromises previously blamed on a patched flaw were actually linked to a separate vulnerability, now identified as CVE-2026-107441. The reported issue could let attackers run OS commands on affected devices via malicious HTTP requests.

Based on the source, the key confirmed point is that the attacks were apparently misattributed at first. The newer assessment suggests defenders may need to revisit whether systems thought to be protected by earlier patches were still vulnerable through another path.

Why it matters for European businesses

Network switches are core infrastructure. Even though they are less visible than servers, laptops or cloud platforms, they can be a valuable target because they sit inside business networks and support day-to-day connectivity. If a switch is compromised, attackers may gain a foothold that can help them monitor traffic, disrupt operations or move further into internal systems.

For SMEs in particular, infrastructure devices are often patched less frequently than endpoints and business applications. A case where active exploitation involves a zero-day rather than the expected known flaw is operationally important because:

• Patching assumptions may be wrong: applying a fix for one issue does not mean the immediate threat is fully addressed if a different vulnerability is involved.
• Internet-exposed management interfaces increase risk: if switch administration is reachable from outside the organisation, exploitation opportunities are typically broader.
• Incident investigations may need to be revisited: teams that closed an incident on the assumption that one patched CVE explained the activity may need to reassess logs, exposure windows and containment steps.
• Third-party and branch-office environments can be overlooked: managed devices in warehouses, retail sites and small offices may not receive the same monitoring as central infrastructure.

Who may be affected

The most directly affected organisations are those using Zyxel switches in offices, retail locations, warehouses, hospitality environments, schools or distributed business networks. The risk is more significant for companies that:

• manage networking equipment through web-based administration interfaces
• allow remote administrative access over the internet or through poorly restricted access paths
• have limited visibility into firmware versions across multiple sites
• depend on external IT providers for network maintenance and patching
• operate under stricter cybersecurity obligations or customer security requirements

Digital agencies, IT service providers and internal IT teams supporting SME estates may also be indirectly affected, especially where they manage networking equipment for multiple clients.

What companies should consider

Businesses using Zyxel networking hardware should avoid assuming that earlier patching or earlier incident conclusions fully resolve the issue. Practical steps to consider include:

• Identify affected assets: confirm whether Zyxel switches are present across headquarters, branch offices and third-party managed sites.
• Check vendor advisories and firmware availability: verify whether updates or mitigation guidance have been published for the specific product models in use.
• Restrict management access: if possible, limit administrative interfaces to internal networks or protected VPN access rather than exposing them directly to the internet.
• Review logs and unusual activity: investigate administrative access attempts, unexpected configuration changes and signs of command execution where logging is available.
• Validate incident assumptions: if previous investigations attributed activity to another Zyxel flaw, reassess whether systems could also have been exposed to CVE-2026-107441.
• Include network devices in vulnerability management: switches, firewalls and similar appliances should be part of routine asset inventory, patching and security monitoring processes.

At this stage, businesses should rely on confirmed vendor and security advisory updates for product scope, fixes and mitigations. The broader lesson is clear: infrastructure devices need the same disciplined security management as servers and cloud systems, especially when active exploitation is involved.