Genian SSL PNS EUVD-2026-90488

Exploitation requires the target to be running Genian SSL PNS (Xenics Auther) with its network-reachable authentication service exposed, and the attacker must know a valid client access ID for that deployment - but crucially NOT the corresponding password (this ID-knowledge requirement is the single attack prerequisite reflected as AT:P). The limiting factors are therefore reachability of the SSL PNS authenticator and possession/enumeration of a legitimate client access ID; no password, no prior session, and no user interaction are needed. Beyond that, no special non-default configuration is documented in the available data.

This is a genuinely high-priority flaw despite thin external corroboration. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation requiring only a single attack prerequisite, and CWE-78 OS command injection in a network-edge SSL/NAC authenticator is a classic target for both opportunistic and targeted attackers. The description's key detail - that an attacker needs to know only the client access ID and NOT the password - confirms PR:N is appropriate and collapses the normal authentication barrier of an SSL access product to a weak, often-guessable or enumerable identifier (reflected as AT:P rather than a password gate). No EPSS score, no CISA KEV listing, and no public POC were provided, and the sole reference is the vendor/coordinated GHSA advisory rather than an exploit write-up, so there is no evidence of active exploitation yet. The vendor-assigned impact (VC:H/VI:L/VA:H) slightly understates integrity for arbitrary command execution; command injection typically yields full control, so VI should arguably be High. Net: treat as a priority to patch because of the remote-unauth RCE profile on a security appliance, while noting exploitation is currently theoretical (no KEV/EPSS/POC signal).

A remote attacker who has learned or enumerated a valid client access ID for a Genian SSL PNS (Xenics Auther) deployment sends a crafted request to the authentication endpoint, injecting shell metacharacters into a parameter that is passed to an OS command without sanitization. Because no password is required, the attacker bypasses normal authentication and executes arbitrary commands on the appliance. No public exploit code or active exploitation has been identified at time of analysis.