Genian NAC EUVD-2026-90489

Exploitation targets the agent upgrade feature of Genian NAC/ZTNA and requires high-privilege access (PR:H) to the upgrade/management function plus the ability to supply a crafted upgrade package; the broken authorization and missing integrity/signature verification on that package let a ZIP Slip (path traversal) entry write outside the extraction directory. Limiting factors: high attack complexity (AC:H), high privilege requirement (PR:H), and no required user interaction (UI:N). Affected releases are Genian NAC 4.0.175, 5.0.65 LTS, 5.0.75 LTS, 5.0.85 Stable, 5.0.86, and Genian ZTNA 6.0.26 LTS, 6.0.35 LTS, 6.0.45 Stable, 6.0.46; upgrade to a vendor-fixed release per GN-SA-2026-001.

Vendor (Genians, via KrCERT reporter) scores this CVSS 4.0 5.9 (Medium) with vector AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N - network-reachable but gated by high attack complexity (AC:H) and high privileges (PR:H), with impact scoped to integrity only despite the RCE claim. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so there is no evidence of active or imminent exploitation. The description's 'execute arbitrary code' outcome sits in tension with the vendor's VC:N/VA:N (integrity-only) impact scoring - true RCE normally implies confidentiality and availability impact as well; this discrepancy should be verified against the GHSA/vendor advisory. CWE-862 (missing authorization) plus 'insufficient authorization and integrity verification' indicates the core weakness is a broken authorization/signature check on the agent-upgrade channel rather than a true authentication bypass. Net: this is a real but not urgent issue - the PR:H and AC:H gating substantially lowers real-world risk, and absence of POC/KEV/EPSS argues against widespread opportunistic exploitation. Priority is moderate, highest for Korean enterprise/government environments where Genian NAC is concentrated.

An attacker who already holds high-privilege access to the Genian NAC/ZTNA management plane crafts a malicious agent upgrade package containing a ZIP Slip path-traversal entry (e.g. '../../') that writes a file outside the intended extraction directory. Because the upgrade feature fails to properly verify authorization and package integrity, the crafted archive is accepted and extracted, planting an executable or script at an attacker-chosen path that is subsequently run, yielding arbitrary code execution. No public exploit code has been identified, and the high attack complexity (AC:H) suggests non-trivial preconditions.