Friday's lead is a reminder that "we patched it" and "it is fixed" are not always the same sentence: Zyxel's June firmware for its GS1900 switches left a nearly identical hole open, and attackers used it to hijack close to a thousand of them. Further down, the SANS Internet Storm Center is catching fresh attempts at a Cisco flaw from 2023, which is the other half of the same lesson. Here is the longer version of today's five, with the version numbers and links that do not fit in three minutes.
Zyxel GS1900: patched in June, hacked anyway
CVE-2026-107441 is an out-of-bounds write in the web management interface of Zyxel's GS1900 series switches, the managed line sold to small businesses. An unauthenticated attacker can use it to run operating system commands at root level, which on a switch means owning the device and watching, or steering, the traffic behind it. BleepingComputer reports that it was exploited as a zero-day to compromise nearly 1,000 switches, a count from the firmware security firm Binarly. The uncomfortable part is the history: Zyxel shipped firmware in June (2.90 patch 2) for the related flaw CVE-2026-7273, a stack buffer overflow that CISA later added to its exploited catalog on September 21 with a three-day deadline. The new flaw bypasses that fix: the June patch checked one thing about incoming parameters and not another, and Zyxel treats the missing size check as this separate bug. The repaired firmware is 2.90 patch 3, released October 22, the per-model builds ending in ".3". One more number worth repeating: researchers at GreyNoise found 564 of the victim switches were still using default credentials. So the checklist is three lines, not one. Get every GS1900 onto the ".3" firmware, take the management page off the internet, and change the factory password while you are in there.
The fix watch: quiet, with Patch Tuesday four days out
Microsoft has posted no new fixes since the October 27 updates, which carry the Smart App Control repair and the Remote Desktop 0xC000000D fix in KB5127653 and KB5127936. The next Patch Tuesday is Tuesday, November 10.
Exchange: Outlook on the web sign-in, day twenty-four
Since the October 13 Windows Server updates, Microsoft says: "Users might be unable to sign in to OWA or send emails on Exchange Server". Windows release health still lists it as Mitigated, a workaround but no fix, across Windows Server 2016 through 2025, unchanged since October 16. The affected updates include KB5126646, KB5126655 and KB5126651. If Tuesday's updates carry the fix, it lands on servers that have this month's workaround in place, so list which of yours do before then.
The install watch: still quiet
No new "this update fails to install" issues from Microsoft; the most recent known-issue changes remain the October 28 fix entries above. If an update fails at your place anyway, note the error code before calling IT: a quiet week means the cause is more likely local than a known problem.
Cisco IOS XE: the 2023 perfect ten is still being probed
CVE-2023-20198 scored CVSS 10.0, the maximum, when it surfaced in October 2023: an unauthenticated attacker who can reach the web UI of a Cisco IOS XE device can create their own full-administrator account on it. CISA added it to the exploited catalog on October 16, 2023 with a four-day deadline, and attackers used it to implant tens of thousands of routers and switches that month. Three years later it is still earning its score. In a diary published yesterday, Johannes Ullrich of the SANS Internet Storm Center reports exploit attempts caught in the Storm Center's honeypots that he suspects target this same flaw. The suspicion is his and he labels it as such, and the practical reading does not depend on it: three-year-old perfect-ten flaws keep getting probed because unpatched devices keep answering. Cisco's fixed IOS XE releases have existed since October 2023. If you run this gear, confirm the fix is actually installed, and keep the web UI off the internet, which is Cisco's standing advice for management interfaces in general.
If you do three things this week
- Get every Zyxel GS1900 switch onto the 2.90 patch 3 firmware, the builds ending ".3", then take its management page off the internet and change the factory password.
- If you run Exchange, list which servers carry the October OWA workaround before Patch Tuesday on November 10, so Tuesday's update lands on a known state.
- Find any Cisco IOS XE device whose web UI faces the internet, confirm it took the October 2023 fix, and move the management page behind the firewall either way.
Clay in the Morning is Senserva's weekday patch and security show; this is its written companion. The sources behind our trackers, and their terms, are on our Data sources & thanks page.