Zyxel GS1900 CVE-2026-107441 + 4 more

If your company uses Zyxel GS1900 series smart managed switches, update the firmware to the fixed version today and make sure the web management UI can be reached only from a small set of admin machines. CVE-2026-107441 lets an unauthenticated attacker on the same network run OS commands on the switch with a crafted HTTP request. Binarly, the researchers who reported it, say it was exploited as a zero-day against almost 1,000 devices. If you self-host Airbyte, update to 2.2 or later. Apple devices stuck on an old OS may be affected by CVE-2024-27834, which CISA just added to its exploited-vulnerabilities list, so check whether those devices can still be updated.

This digest is based on the Zyxel advisory, Binarly's blog, SecurityWeek, CISA KEV, NVD, JVN, the Airbyte advisory, the Debian security tracker, Siemens, and VulnCheck, checked on November 5, 2026 (JST). Anything not stated is treated as 'not stated.' Four of today's five items are reported or confirmed as exploited (Zyxel, Apple, Airbyte, Node-RED), and the source of that statement differs for each; the table shows which.

The CGI program in GS1900 firmware (the code behind the web management UI) has an out-of-bounds write, a flaw that lets data be written outside the memory it should touch. According to Zyxel's advisory, an unauthenticated attacker on the same network (LAN) could execute OS commands through a crafted HTTP request. NVD published it on November 3 with a CVSS 3.1 score of 8.8 (High), assigned by Zyxel.

In plain terms, a switch that sits at the center of your office wiring could be taken over by someone already on the network. Control of a switch can allow traffic to be watched or serve as a foothold for attacking other devices. This is not an 'anyone on the internet can walk in' flaw; the attacker first needs to be on the same LAN. That assumption weakens if the management UI is exposed externally, or if guest Wi-Fi and personal devices share a network with business systems.

- Affected versions: 2.90(XXXX.2)C0 and earlier for each model, as listed below
- Fixed versions: 2.90(XXXX.3)C0 for each model. Zyxel says patches are provided only for models still within their support period
- Exploitation: Zyxel's advisory does not mention it. Binarly, who reported the flaw to Zyxel, says it was exploited as a zero-day against almost 1,000 devices, in attacks previously attributed to a China-linked actor. SecurityWeek (November 5) reports the same
- The June update does not protect you: CVE-2026-7273, patched in June, was not the bug used in these attacks. Having applied that update does not help; you need the fixed firmware released on or after October 23
- Timeline: Binarly reported it to Zyxel on September 29, and fixes were released on October 23
- CISA KEV: not in the catalog as of November 4

Workarounds and how to check: first, if you use one of these models, download the fixed firmware for it from Zyxel's official support site and update. Second, confirm the switch's web management UI is not exposed to the internet. Third, limit which machines can open the UI to a management VLAN (a separate virtual network for administrators) or to admin PCs. You can see the current version on the information screen after logging in to the web UI. Models past their support period get no patch, so plan to replace them or place them where the management interface is unreachable. For broader network defenses, see also our UTM and firewall cost article. Sources: Zyxel advisory, Binarly blog, SecurityWeek

CVE-2024-27834 affects Apple's iOS, iPadOS, macOS, Safari, tvOS and watchOS and is classified as improper authentication. An attacker who already has arbitrary read/write capability may be able to bypass Pointer Authentication, a protection that makes memory-corruption attacks harder. NVD rates it CVSS 3.1 5.5 (Medium). CISA added it to the KEV catalog (known exploited vulnerabilities) on November 4, with a due date of November 18 for U.S. federal agencies.

The key point is that the flaw itself is old and was fixed in May 2024. The only new fact is the KEV addition. News reports say it was used in attacks that deliver info-stealing malware; that part is based on press reporting, and what this article verified from primary sources is the KEV listing.

- Fixed versions: Safari 17.5, iOS 16.7.8 / iPadOS 16.7.8, iOS 17.5 / iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5
- Practical risk: devices on a current OS already have the fix. The risk is devices stuck on an old OS that no longer receives updates (old iPhones, iPads and Macs past their useful life)
- Exploitation: added to CISA KEV; news reports say it was used to deliver info-stealing malware

How to check: on an iPhone or iPad, open Settings, General, About to see the iOS or iPadOS version; on a Mac, use About This Mac. If the version is at or above the fixed releases above, you are covered. For old devices that no longer get updates, the practical step is to stop using them for business email, internal systems and password management. Sources: CISA KEV, NVD

Airbyte is a data integration tool that collects data from various business systems and sends it elsewhere. The self-managed edition, which you run on your own servers, has an unsafe reflection flaw (CWE-470, a weakness where external input decides what code the program runs). According to JVN, a user with Airbyte privileges could execute arbitrary code in the Connector Builder or ManifestServer container. JVN published it on November 4; JVN lists no CVE number. The identifiers are JVN#12040144 and GHSA-g35w-6r6v-h4r7.

- What can happen: someone who can use Airbyte's UI or API can run arbitrary programs inside the server's containers, which could lead to leakage of connected databases or credentials
- Severity: JVN rates it CVSS v4.0 8.7 and v3.0 8.8 and labels it 'critical' (緊急). Airbyte's own rating is CVSS 3.1 9.9
- Affected versions: Airbyte 1.7.0 through 2.1.0 (JVN)
- Fixed version: Airbyte 2.2 or later; the release notes are linked below. SecurityOnline reports that the 1.x line will not get a fix
- Exploitation: JVN states that exploitation has been confirmed

In plain terms, a design that treated 'people who can log in to Airbyte' as the trust boundary turned out to give a foothold for running code inside the system. An outside attacker cannot simply walk in, but damage grows if credentials leak or privileges are handed out broadly. How to check and respond: confirm your current version in the admin UI or deployment settings, and if it is between 1.7.0 and 2.1.0, update to 2.2 or later. Until then, make the UI and API reachable only from a small set of internal machines and remove unneeded user permissions. Sources: JVN#12040144, GitHub advisory, Airbyte 2.2 release notes

APT is the standard tool for installing and updating software on Debian and Ubuntu. NVD published CVE-2026-109518 on November 4. During a package install, an on-path attacker who can manipulate HTTP traffic between the APT client and the archive (including a malicious mirror or proxy) can make APT install an attacker-controlled package that has not been verified, leading to code execution as root. The cause is hard link reuse.

- Conditions: it requires following redirects and retrying downloads, which happens only when Acquire::Retries is non-zero. That is the default (3) on Debian 12 (bookworm) and Ubuntu 22.04 LTS; older releases are not affected by default
- Severity: CVSS v4.0 7.7 (High), assigned by Ubuntu as CNA
- Fixed apt versions: Debian 12 bookworm 2.6.2 (vulnerable 2.6.1, DLA-4880-1); Debian 13 trixie 3.0.4 (vulnerable 3.0.3, DSA-6607-1); forky/sid 3.3.6
- Ubuntu: check Ubuntu's official page for the fixed versions
- Exploitation: none reported

In plain terms, it is a flaw that lets someone swap the package in transit while getting past APT's verification. The attack needs a position where traffic can be manipulated, so using HTTPS mirrors on a trusted network keeps the practical risk low. To check your version:

Compare the version shown with the fixed versions above. If Debian 12 still shows 2.6.1 or Debian 13 still shows 3.0.3, update with the usual apt update and apt upgrade. Until then, use HTTPS mirrors and avoid untrusted proxies or mirrors. If automation uses APT when building servers or rebuilding containers, check the apt version in those images too. Sources: Debian security tracker, NVD, Ubuntu

Node-RED is a tool for building connections between devices and services by wiring components together on screen. According to Siemens advisory SSA-834709 (August), on SIMATIC IoT2050 devices running Industrial OS with Node-RED installed, all versions before V4.3.4-1 let an unauthenticated remote attacker execute arbitrary code with maximum privileges. Siemens rates it 10.0 (Critical) under both CVSS 3.1 and 4.0.

- Exploitation: VulnCheck reports exploitation observed from October 30 (blog updated November 1; Help Net Security reported it on November 3). Attackers post a Node-RED flow through the unauthenticated admin API; the flow downloads and runs a Linux bot (bot-linux-amd64) and drops webshells. VulnCheck says Node-RED instances without adminAuth are found and exploited automatically
- Listings: VulnCheck added it to its own KEV. It was not in CISA KEV as of November 4
- Affected: SIMATIC IoT2050 devices running Industrial OS with Node-RED installed, before V4.3.4-1
- Fixed version: IoT2050 V4.3.4-1 or later

In plain terms, a device that connects equipment on the floor can be taken over quickly if it is visible from the outside with no lock on the door. How to check and respond: first, do not expose Node-RED to the internet. Second, enable adminAuth in the settings file so the editor and admin API require login. Third, update IoT2050 to V4.3.4-1 or later. Fourth, review existing flows for unexpected exec nodes (components that run OS commands) or unexpected HTTP endpoints. For IoT defenses, our vulnerability assessment cost article may also help. Sources: Siemens SSA-834709, VulnCheck blog, Help Net Security

- Ask your IT contact or installer whether any office, store or factory uses Zyxel GS1900 series switches (8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48, 48HPv2)
- If so, check whether the firmware is on the fixed version (2.90(XXXX.3)C0) and schedule the update if not. Having done the June update does not cover this issue
- Confirm the switch web UI is not visible from the internet and that only admin PCs and similar machines can open it
- Switches past their support period get no patch; decide whether to replace them or move them where the management interface is unreachable
- List any old iPhones, iPads or Macs whose OS updates have stopped, and consider removing them from business use or replacing them
- If you run Airbyte yourself, check the version and ask for an update to 2.2 or later if it is 1.7.0 to 2.1.0; until then limit the UI and API to a small set of internal machines
- If you have Debian 12/13 or Ubuntu servers, check the apt version and update to the fixed version; also confirm HTTPS mirrors are used
- If you use Siemens SIMATIC IoT2050 or Node-RED, confirm it is not exposed to the internet and that adminAuth is enabled
- Record the result of each check and update (date, version, who did it) on a single sheet for the next inventory

- Vulnerability Digest, November 4
- Vulnerability Digest, November 3
- Vulnerability assessment cost
- UTM and firewall cost
- Linux kernel Copy Fail (CVE-2026-31431) mitigation

- Zyxel security advisory (GS1900 out-of-bounds write, Nov 3, 2026)
- Binarly: Zyxel GS1900 RCE CVE-2026-107441
- SecurityWeek: Zyxel switch hacks blamed on patched flaw were actually a zero-day
- CISA KEV catalog
- NVD: CVE-2024-27834
- JVN#12040144 (Airbyte)
- GitHub: GHSA-g35w-6r6v-h4r7
- Airbyte 2.2 release notes
- Debian security tracker: CVE-2026-109518
- NVD: CVE-2026-109518
- Ubuntu: CVE-2026-109518
- Siemens SSA-834709
- VulnCheck: exploitation targeting Node-RED
- Help Net Security: Node-RED CVE-2026-58115 exploitation