A patch that does not fix the bug it was meant to fix is worse than no patch at all, because it tells administrators the problem is handled. That appears to be what happened with Zyxel's GS1900 switches. According to Binarly, a June 2026 firmware change for CVE-2026-7273 added a check that ran only after the unsafe copy had already taken place. In the researchers' words, the change "does not address the vulnerability."
The stakes are concrete. GreyNoise reported on September 21 that an attacker had exploited CVE-2026-7273 against 996 Zyxel GS1900 switches in 48 countries, taking switch configurations, hashed root credentials and networking information. The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog the same day. Binarly then confirmed on September 28 that all 10 firmware releases shipped as the June fix remained vulnerable.
The dispute over what to call this flaw matters less than the outcome for people who run these switches. Binarly offers two possibilities: either Zyxel's June patch, description and CVSS score were wrong, or the attacks used a different flaw and CISA's link is mistaken. Either way, Binarly says all 10 releases advertised as fixes contain the vulnerable code. Zyxel rates the new identifier CVE-2026-107441 at 8.8 and says local network access is needed, while Binarly rates it 9.8 and says only network access to the management service is required. An administrator deciding how urgently to act should not have to pick between those scores.
Zyxel's timeline also deserves scrutiny. Binarly says it notified the company on September 29. Zyxel confirmed the flaw on October 11, released a fix on October 22 and published its advisory on November 3. That is more than a month from notification to advisory, for a device already tied to a campaign spanning dozens of countries.
Zyxel should state plainly that the June release did not remediate the exploited flaw, and it should revise the advisory and its scoring so that users are not left reading a list of affected versions that includes the very firmware they installed as a fix. Its advice to install updates "for optimal protection" is correct but insufficient. Switches last updated in June should be treated as still exposed until the October 22 firmware is installed, and any device that may have been reachable should have its credentials rotated.