Genian NAC CVE-2026-16520

No special conditions are required - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote unauthenticated exploitation against default configurations of Genian NAC and ZTNA. Any instance with its web interface reachable over a network is vulnerable. Exploitation is limited to versions prior to the fixed releases on each supported branch; upgraded instances are not affected. The only limiting factor is network reachability to the management interface; deployments that restrict management access to trusted internal networks reduce exposure but are not immune.

The CVSS 4.0 score of 8.7 with a vector of AV:N/AC:L/AT:N/PR:N/UI:N/VC:H accurately characterizes a high-severity, remotely exploitable flaw requiring no privileges or user interaction. The authentication bypass component means attackers can potentially gain access to NAC management functions before leveraging SQL injection for data exfiltration - an especially dangerous combination in a product whose purpose is to control network access. No CISA KEV listing and no known public exploit code reduce the immediate threat-actor activity signal, though the low exploitation complexity makes opportunistic scanning a realistic near-term risk. EPSS data was not provided, so exploitation probability cannot be quantified. The CVSS 4.0 high confidentiality impact (VC:H) and absence of integrity or availability impact (VI:N/VA:N) suggest the primary confirmed impact is data exposure from the underlying database, though authentication bypass may unlock further attack surface not captured in these metrics.

An unauthenticated remote attacker sends a crafted HTTP request to a Genian NAC or ZTNA web interface endpoint that processes data queries, injecting malicious SQL syntax into an input parameter. The injected payload manipulates the authentication query to return a valid session or extract credential hashes from the backend database, granting the attacker access to NAC management functions or sensitive network inventory data without valid credentials. No public exploit code has been identified at time of analysis, but the low attack complexity makes independent exploitation development straightforward.