EUVD-2026-63775
GHSA-78xj-r982-5m2q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint (PR:N, AV:N); only confidentiality impact confirmed (C:H); no integrity or availability impact per CVSS 4.0 VI:N/VA:N.
Primary rating from Vendor (FSI).
CVSS VectorVendor: FSI
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass.
This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175(Revision 150340); Genian NAC V5.0: from 5.0.0 before 5.0.65 LTS(Revision 150331), from 5.0.0 before 5.0.75 LTS(Revision 150330), from 5.0.0 before 5.0.87 Release Stable(Revision 150329), and from 5.0.0 before 5.0.88(Revision 150328); Genian ZTNA V6.0: from 6.0.0 before 6.0.26 LTS(Revision 150337), from 6.0.0 before 6.0.35 LTS(Revision 150336), from 6.0.0 before 6.0.47 Release Stable(Revision 150334), and from 6.0.0 before 6.0.48(Revision 150333).
AnalysisAI
SQL injection and authentication bypass in Genians Genian NAC (V4.0, V5.0) and ZTNA (V6.0) expose sensitive backend data to remote unauthenticated attackers via crafted data queries. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack prerequisites, consistent with the authentication bypass tag. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote unauthenticated exploitation against default configurations of Genian NAC and ZTNA. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with a vector of AV:N/AC:L/AT:N/PR:N/UI:N/VC:H accurately characterizes a high-severity, remotely exploitable flaw requiring no privileges or user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the patched releases as appropriate for your deployed branch: Genian NAC V4.0 users should upgrade to 4.0.175 (Revision 150340) or later; Genian NAC V5.0 users should upgrade to 5.0.65 LTS (Revision 150331), 5.0.75 LTS (Revision 150330), 5.0.87 Release Stable (Revision 150329), or 5.0.88 (Revision 150328) depending on their tracked branch; Genian ZTNA V6.0 users should upgrade to 6.0.26 LTS (Revision 150337), 6.0.35 LTS (Revision 150336), 6.0.47 Release Stable (Revision 150334), or 6.0.48 (Revision 150333) for their respective branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Genian NAC and ZTNA deployments (V4.0, V5.0, V6.0) and restrict network access to management interfaces via firewall rules; disable remote access if not operationally critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today