It Said Patched. It Wasn't: How to Check Your Network Gear Is Really Safe

You applied the update, the ticket was closed and the dashboard turned green. For most IT teams, that is the end of the story. Recent events show why it should not be.

In the past few weeks, a switch maker's security fix turned out not to fix the flaw being exploited, a VPN vendor asked customers who had just patched to upgrade again, and a firewall vendor told customers to install updates before it explains what they fix. For businesses across the UAE and GCC, the lesson is simple: "patched" is a claim that needs checking, not a status that lasts.

A fix that did not fix the flaw

In June, Zyxel released firmware for its GS1900 series switches to fix a flaw in their web management program. In September, threat intelligence firm GreyNoise reported that an attacker had exploited that flaw against 996 GS1900 switches in 48 countries, taking switch configurations, hashed root passwords and network details.

On 3 November, firmware security company Binarly published research showing that all 10 firmware releases shipped as the June fix were still vulnerable to the exploit used in those attacks. The June change added a safety check, but only after the unsafe step had already happened. The flaw now has a new identifier, CVE-2026-107441, and lets an unauthenticated attacker run commands as root. Zyxel released new firmware on 22 October and published its advisory on 3 November. Its advisory lists the June releases as affected, so any GS1900 switch last updated in June still needs the new firmware.

Patched once, patch again

Ivanti fixed an authentication bypass in its Connect Secure VPN (CVE-2026-104935) on 13 October. Attackers had chained it with two further zero-day flaws to gain root access on appliances that were fully patched at the time. Ivanti has since fixed those two flaws as well, in versions 25.1.1.3 and 22.8R2.6. As SecurityWeek reported, the releases that fixed the first flaw were 25.1.1.2 and 22.8R2.5, so organisations that patched promptly in October need to upgrade a second time. The attackers focused on stealing credentials, taking data and tampering with logs, which is why a quick upgrade alone may not be enough.

Lists that keep growing, and products that will never be fixed

Two more developments show why a single check is not enough:

• Cisco and Node2Shell. On 4 November Cisco updated its advisory on Node2Shell (CVE-2026-111497), an exploited flaw in a widely used data compression library. According to SecurityWeek, 19 Cisco products are now confirmed affected and dozens more are still under investigation. A product that was "not affected" last week may be on the list next week.
• SonicWall GMS. SonicWall's Global Management System reached end of life in October 2025. SonicWall has now disclosed two flaws in it, including a critical file-read bug that needs no login, and says they will not be fixed. For anyone still running GMS, there is no patch to wait for.

Fixes first, details later

Fortinet released updates for FortiOS, FortiManager and FortiAnalyzer on 22 October, including fixes for flaws found with the help of frontier AI models. It will only publish the full advisories, with CVE numbers and severity scores, on 10 November. Fortinet warns that once fixes are public, attackers can use AI tools to compare old and new code and build working exploits in hours or days.

That puts a date in the diary. Any FortiGate that has not reached the fixed release (for example 7.4.13 or 7.6.8, depending on your branch) by 10 November will be running code with published weaknesses. Microsoft's monthly security updates are due on the same day.

Why "patched" is not the same as "safe"

These cases point to four gaps in a typical patching process:

1. The fix can be wrong or incomplete. Vendors are under pressure to ship quickly, and a patch sometimes misses the real cause.
2. The advisory changes after you act. New flaws are added to existing advisories and affected product lists grow.
3. Patching does not remove an attacker who is already in. If a device was exploited before the update, the backdoor, stolen passwords and altered logs remain.
4. Some products will never be patched. End-of-life equipment stays vulnerable for as long as it stays in service.

What UAE and GCC organisations should do now

1. Keep a live inventory with firmware versions. List every switch, firewall, VPN, management platform and storage device, with its exact software version and support status.
2. Check versions against the latest advisory, not the original one. When a vendor updates an advisory, compare your installed version with the newest fixed release, not the one you installed last time.
3. Subscribe to vendor security alerts. Make sure someone receives and reads them for every product you run, and recheck when an advisory is revised.
4. Look for compromise after patching. For devices that were exposed before the fix, review admin logins, configuration changes and unexpected files, and rotate the passwords and keys they hold.
5. Book your change windows. Plan Fortinet and Microsoft updates around 10 November now, starting with internet-facing devices.
6. Keep management interfaces off the internet. Restrict admin access to a management network or VPN, as we explained in our article on firewall admin pages exposed to the internet.
7. Retire end-of-life equipment. Budget to replace products that no longer receive security fixes, and isolate them until you do.

Verify, then verify again

Patching is still the most effective defence most businesses have. It just needs a second step: confirm the fix is the right one, recheck when the vendor's advice changes, and make sure nobody got in before you closed the door.

COMMPRO Technologies supplies switches, firewalls and secure remote access solutions from leading vendors across the UAE and GCC. If you would like help checking your network equipment against the latest advisories or planning replacements for end-of-life devices, contact our team.