Read the docs
TI-2026-53271 Aliases CVE-2026-76147GHSA-mp5x-q6p4-5326

Genians, Inc Genian NAC/ZTNA Remote Code Execution

Priority LOW 27CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00403 34th percentileScored 2026-11-07
Fix Fixed Genian NAC 4.0.175 Release (Genians, Inc): 148817Genian NAC 5.0.65 LTS Release (Genians, Inc): 148816+7 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GeniansGenian NAC 4.0.175 Releasebefore 148817148817Patch availableCNA
GeniansGenian NAC 5.0.65 LTS Releasebefore 148816148816Patch availableCNA
GeniansGenian NAC 5.0.75 LTS Releasebefore 148815148815Patch availableCNA
GeniansGenian NAC 5.0.85 Release Stablebefore 148814148814Patch availableCNA
GeniansGenian NAC 5.0.86 Releasebefore 148813148813Patch availableCNA
GeniansGenian ZTNA 6.0.26 LTS Releasebefore 148811148811Patch availableCNA
GeniansGenian ZTNA 6.0.35 LTS Releasebefore 148810148810Patch availableCNA
GeniansGenian ZTNA 6.0.45 Release Stablebefore 148809148809Patch availableCNA
GeniansGenian ZTNA 6.0.46 Releasebefore 148807148807Patch availableCNA
  • Genian NAC 4.0.175 Release VendorGenians Affected before 148817 Fixed in 148817 Patch available CNA
  • Genian NAC 5.0.65 LTS Release VendorGenians Affected before 148816 Fixed in 148816 Patch available CNA
  • Genian NAC 5.0.75 LTS Release VendorGenians Affected before 148815 Fixed in 148815 Patch available CNA
  • Genian NAC 5.0.85 Release Stable VendorGenians Affected before 148814 Fixed in 148814 Patch available CNA
  • Genian NAC 5.0.86 Release VendorGenians Affected before 148813 Fixed in 148813 Patch available CNA
  • Genian ZTNA 6.0.26 LTS Release VendorGenians Affected before 148811 Fixed in 148811 Patch available CNA
  • Genian ZTNA 6.0.35 LTS Release VendorGenians Affected before 148810 Fixed in 148810 Patch available CNA
  • Genian ZTNA 6.0.45 Release Stable VendorGenians Affected before 148809 Fixed in 148809 Patch available CNA
  • Genian ZTNA 6.0.46 Release VendorGenians Affected before 148807 Fixed in 148807 Patch available CNA

Remediation

  • Fix · CNA Genian NAC 4.0.175 Release (Genians, Inc) Fixed in 148817
  • Fix · CNA Genian NAC 5.0.65 LTS Release (Genians, Inc) Fixed in 148816
  • Fix · CNA Genian NAC 5.0.75 LTS Release (Genians, Inc) Fixed in 148815
  • Fix · CNA Genian NAC 5.0.85 Release Stable (Genians, Inc) Fixed in 148814
  • Fix · CNA Genian NAC 5.0.86 Release (Genians, Inc) Fixed in 148813
  • Fix · CNA Genian ZTNA 6.0.26 LTS Release (Genians, Inc) Fixed in 148811
  • Fix · CNA Genian ZTNA 6.0.35 LTS Release (Genians, Inc) Fixed in 148810
  • Fix · CNA Genian ZTNA 6.0.45 Release Stable (Genians, Inc) Fixed in 148809
  • Fix · CNA Genian ZTNA 6.0.46 Release (Genians, Inc) Fixed in 148807

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76147
  2. 2026-10-03 Alias added: GHSA-mp5x-q6p4-5326

References

Other 2

  • TI-2023-21103 SQL injection in Genians Genian NAC V4.0 CVSS 3.1CRITICAL 9.8
  • TI-2021-08340 Genian NAC remote code execution vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2026-53266 Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface CVSS 4.0CRITICAL 9.3
  • TI-2026-13788 Improper input validation in Genians Genian NAC V4.0 CVSS 4.0HIGH 8.7
  • TI-2026-53270 Genians, Inc Genian SSL PNS OS Command Injection CVSS 4.0HIGH 8.4
  • TI-2023-21102 OS command injection in Genians Genian NAC V4.0 CVSS 3.1CRITICAL 9.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences