Read the docs
TI-2026-13788 Aliases CVE-2026-16520GHSA-78xj-r982-5m2q

Improper input validation in Genians Genian NAC V4.0

Priority MEDIUM 44CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175(Revision 150340); Genian NAC V5.0: from 5.0.0 before 5.0.65 LTS(Revision 150331), from 5.0.0 before 5.0.75 LTS(Revision 150330), from 5.0.0 before 5.0.87 Release Stable(Revision 150329), and from 5.0.0 before 5.0.88(Revision 150328); Genian ZTNA V6.0: from 6.0.0 before 6.0.26 LTS(Revision 150337), from 6.0.0 before 6.0.35 LTS(Revision 150336), from 6.0.0 before 6.0.47 Release Stable(Revision 150334), and from 6.0.0 before 6.0.48(Revision 150333).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00545 45th percentileScored 2026-11-07
Fix Fixed Genian NAC V4.0 (Genians): 4.0.175(Revision 150340)Genian NAC V5.0 (Genians): 5.0.65 LTS(Revision 150331), 5.0.75 LTS(Revision 150330), 5.0.87 Release Stable(Revision 150329) +1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GeniansGenian NAC V4.04.0.0 to before 4.0.175(Revision 150340)4.0.175(Revision 150340)Patch availableCNA
GeniansGenian NAC V5.05.0.0 to before 5.0.65 LTS(Revision 150331); 5.0.0 to before 5.0.75 LTS(Revision 150330); 5.0.0 to before 5.0.87 Release Stable(Revision 150329); 5.0.0 to before 5.0.88(Revision 150328)5.0.65 LTS(Revision 150331), 5.0.75 LTS(Revision 150330), 5.0.87 Release Stable(Revision 150329), 5.0.88(Revision 150328)Patch availableCNA
GeniansGenian ZTNA V6.06.0.0 to before 6.0.26 LTS(Revision 150337); 6.0.0 to before 6.0.35 LTS(Revision 150336); 6.0.0 to before 6.0.47 Release Stable(Revision 150334); 6.0.0 to before 6.0.48(Revision 150333)6.0.26 LTS(Revision 150337), 6.0.35 LTS(Revision 150336), 6.0.47 Release Stable(Revision 150334), 6.0.48(Revision 150333)Patch availableCNA
  • Genian NAC V4.0 VendorGenians Affected 4.0.0 to before 4.0.175(Revision 150340) Fixed in 4.0.175(Revision 150340) Patch available CNA
  • Genian NAC V5.0 VendorGenians Affected 5.0.0 to before 5.0.65 LTS(Revision 150331); 5.0.0 to before 5.0.75 LTS(Revision 150330); 5.0.0 to before 5.0.87 Release Stable(Revision 150329); 5.0.0 to before 5.0.88(Revision 150328) Fixed in 5.0.65 LTS(Revision 150331), 5.0.75 LTS(Revision 150330), 5.0.87 Release Stable(Revision 150329), 5.0.88(Revision 150328) Patch available CNA
  • Genian ZTNA V6.0 VendorGenians Affected 6.0.0 to before 6.0.26 LTS(Revision 150337); 6.0.0 to before 6.0.35 LTS(Revision 150336); 6.0.0 to before 6.0.47 Release Stable(Revision 150334); 6.0.0 to before 6.0.48(Revision 150333) Fixed in 6.0.26 LTS(Revision 150337), 6.0.35 LTS(Revision 150336), 6.0.47 Release Stable(Revision 150334), 6.0.48(Revision 150333) Patch available CNA

Remediation

  • Fix · CNA Genian NAC V4.0 (Genians) Fixed in 4.0.175(Revision 150340)
  • Fix · CNA Genian NAC V5.0 (Genians) Fixed in 5.0.65 LTS(Revision 150331), 5.0.75 LTS(Revision 150330), 5.0.87 Release Stable(Revision 150329), 5.0.88(Revision 150328)
  • Fix · CNA Genian ZTNA V6.0 (Genians) Fixed in 6.0.26 LTS(Revision 150337), 6.0.35 LTS(Revision 150336), 6.0.47 Release Stable(Revision 150334), 6.0.48(Revision 150333)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-16520
  2. 2026-10-03 Alias added: GHSA-78xj-r982-5m2q

References

Other 2

  • TI-2023-21103 SQL injection in Genians Genian NAC V4.0 CVSS 3.1CRITICAL 9.8
  • TI-2021-08340 Genian NAC remote code execution vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2026-53266 Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface CVSS 4.0CRITICAL 9.3
  • TI-2026-53270 Genians, Inc Genian SSL PNS OS Command Injection CVSS 4.0HIGH 8.4
  • TI-2023-21102 OS command injection in Genians Genian NAC V4.0 CVSS 3.1CRITICAL 9.8
  • TI-2023-21101 Code injection in Genians Genian NAC V4.0 CVSS 3.1CRITICAL 9.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences