Zyxel's patch for *exploited* switches fixed the wrong bug

The patch that missed

Zyxel released a firmware update for its GS1900 network switches in response to reports that CVE-2026-107441 was being exploited in the wild ^[2]. The company's security bulletin said the patch closed the vulnerability. It didn't. Researchers at Binarly found that the update fixed a different bug, CVE-2026-7273, and left the exploited flaw wide open ^[1].

It's a bit like getting a recall notice for a faulty brake and finding out the garage fixed the handbrake instead. The car drives away, the owner thinks it's safe, and the brakes are still dodgy.

For anyone running those switches, the immediate question is whether they are protected. For manufacturers, suppliers and supervisors, the wider question is harder: when something like this happens, how do you show which version was running on each device, and when the correct patch finally went on?

What happened

CVE-2026-107441 is a vulnerability in Zyxel's GS1900 series switches ^[2]. According to HelpNet Security, it was reported as actively exploited ^[2]. Zyxel issued a patch. Binarly analysed the firmware and found that the code changes addressed CVE-2026-7273, not the vulnerability under attack ^[1].

The company has since released a corrected update ^[1]. Devices that received only the first patch remain vulnerable to the original exploit.

The evidence question

Patches are meant to close holes. When one closes the wrong hole, or when an update is pulled and reissued, the question moves from 'is the device patched?' to 'which version is it running, and since when?'.

For the organisation that bought the switches, the question is straightforward: can we show an auditor or a supervisor that we applied the correct patch, and when? For a manufacturer reporting an incident under the Cyber Resilience Act, the question is similar: can we show which customers received which version, and at what time?

Configuration management systems and patch logs answer part of that. The harder part is showing that the log itself hasn't been edited after the fact, for example to make a missed deadline look met.

What the CRA asks for

The Cyber Resilience Act applies from 11 September 2026 to manufacturers of products with digital elements ^[3]. Article 14 sets strict reporting deadlines. If a vulnerability is actively exploited, the manufacturer must send an early warning within 24 hours of becoming aware of it, a full incident notification within 72 hours, and a final report within a month ^[3].

The clock starts when the manufacturer becomes aware, not when it suits them. An incomplete patch, a withdrawn update or a corrected release all add steps to the timeline. If a supervisor later asks why an early warning went out after 30 hours instead of 24, the manufacturer needs to show when it first knew.

The regulation doesn't say how to keep that timeline intact. It says the timeline matters.

Sealing an incident timeline

Here, the thing to seal is each step as it happens: the first detection note, the decision to escalate, the report as it was sent and each corrected patch as it was released. Sealing takes a fingerprint of the record, not the record itself, so nothing leaves your systems.

You seal through WitniumChain's REST API, SDK or MCP server as each step happens. Internal audit, supervisors and insurers can later check that the record is exactly what was written at that time. Change a date or a sentence and the fingerprint won't match. The record stays with you; the fingerprint is what gets sealed.

What it shows is when each step was recorded, in a way nobody can quietly rewrite afterwards. What it doesn't show is that the response was adequate, that the patch was correct the first time, or that the report was complete. Those are different questions.

How it would work

1. The manufacturer's incident system records the first detection and sends a fingerprint to the witness.
2. Each report and each corrected release is sealed as it happens.
3. When a supervisor asks about the timeline, the manufacturer shares the records and anyone can check the fingerprints.

What this means for you

If you're running Zyxel GS1900 switches, check which firmware version is on each device and apply the corrected patch ^[1]. If you're building or selling products with digital elements, ask now:

• When a vulnerability is reported, how quickly do we know which versions are affected and which customers have them?
• If we have to issue a corrected patch, can we show when the first version went out, when we pulled it, and when the correct one was applied?
• Could we show a supervisor that we met the 24-hour deadline, if the question came up six months later?

The patching itself is technical. The timeline is evidence.

What to watch

The Cyber Resilience Act's reporting requirements apply from 11 September 2026 ^[3]. The basic security requirements for products, including logging and vulnerability handling, apply from 11 December 2027 ^[3]. Manufacturers should decide now how they will keep records that can be checked later, because once a deadline is missed, it's too late to go back and seal the timeline.

Sources

^[1] Patched Zyxel switches remained vulnerable to the in-the-wild exploited bug, Help Net Security, 5 November 2026, https://www.helpnetsecurity.com/2026/11/05/zyxel-cve-2026-107441-exploit/

^[2] Cited as source in ^[1] for active exploitation reports

^[3] Regulation (EU) 2024/2847 on cybersecurity requirements for products with digital elements (Cyber Resilience Act), Article 14, European Commission, https://eur-lex.europa.eu/eli/reg/2024/2847/oj