Genians
Monthly
OS command injection in Genian SSL PNS (Xenics Auther) lets a remote attacker execute arbitrary operating-system commands on the host, with the only documented prerequisite being knowledge of a valid client access ID rather than the matching password. The flaw is tracked as CVE-2026-76146 (CWE-78) and carries a CVSS 4.0 base score of 8.4, where the AT:P attack-requirement metric encodes that access-ID precondition while PR:N/UI:N confirm no credentials and no user interaction are needed. Public reporting so far is limited to the vendor's own security-research advisory (GHSA-2597-v98f-frhj) issued via KR-CERT, there is no CISA KEV entry, and no public exploit code has been identified at time of analysis, so this is a genuine high-impact exposure without confirmed active exploitation.
SQL injection and authentication bypass in Genians Genian NAC (V4.0, V5.0) and ZTNA (V6.0) expose sensitive backend data to remote unauthenticated attackers via crafted data queries. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack prerequisites, consistent with the authentication bypass tag. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the unauthenticated, low-complexity nature warrants prompt patching across all three product lines.
High-privilege authenticated users can abuse the agent upgrade feature in Genian NAC and Genian ZTNA to write files outside the intended extraction directory via a ZIP Slip path traversal (CWE-862, missing authorization and integrity verification), which can result in arbitrary code execution on the appliance. Affected releases include Genian NAC 4.0.175, 5.0.65 LTS, 5.0.75 LTS, 5.0.85 Stable, and 5.0.86, plus Genian ZTNA 6.0.26 LTS, 6.0.35 LTS, 6.0.45 Stable, and 6.0.46. Exploitation is gated by high attack complexity and a high privilege requirement (PR:H) on the upgrade/management function, and there is no public exploit identified at time of analysis; the vendor (via KrCERT) scores it CVSS 4.0 5.9 Medium with integrity-only impact, while an independent assessment rates CVSS 3.1 7.0 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) reflecting the possible RCE outcome.
Improper Control of Generation of Code ('Code Injection') vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Replace Trusted. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Man in the Middle Attack.0: from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Download of Code Without Integrity Check vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Malicious Software Update.0: from. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Authentication vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Authentication Abuse.0: from V4.0.0 through. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
OS command injection in Genian SSL PNS (Xenics Auther) lets a remote attacker execute arbitrary operating-system commands on the host, with the only documented prerequisite being knowledge of a valid client access ID rather than the matching password. The flaw is tracked as CVE-2026-76146 (CWE-78) and carries a CVSS 4.0 base score of 8.4, where the AT:P attack-requirement metric encodes that access-ID precondition while PR:N/UI:N confirm no credentials and no user interaction are needed. Public reporting so far is limited to the vendor's own security-research advisory (GHSA-2597-v98f-frhj) issued via KR-CERT, there is no CISA KEV entry, and no public exploit code has been identified at time of analysis, so this is a genuine high-impact exposure without confirmed active exploitation.
SQL injection and authentication bypass in Genians Genian NAC (V4.0, V5.0) and ZTNA (V6.0) expose sensitive backend data to remote unauthenticated attackers via crafted data queries. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack prerequisites, consistent with the authentication bypass tag. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the unauthenticated, low-complexity nature warrants prompt patching across all three product lines.
High-privilege authenticated users can abuse the agent upgrade feature in Genian NAC and Genian ZTNA to write files outside the intended extraction directory via a ZIP Slip path traversal (CWE-862, missing authorization and integrity verification), which can result in arbitrary code execution on the appliance. Affected releases include Genian NAC 4.0.175, 5.0.65 LTS, 5.0.75 LTS, 5.0.85 Stable, and 5.0.86, plus Genian ZTNA 6.0.26 LTS, 6.0.35 LTS, 6.0.45 Stable, and 6.0.46. Exploitation is gated by high attack complexity and a high privilege requirement (PR:H) on the upgrade/management function, and there is no public exploit identified at time of analysis; the vendor (via KrCERT) scores it CVSS 4.0 5.9 Medium with integrity-only impact, while an independent assessment rates CVSS 3.1 7.0 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) reflecting the possible RCE outcome.
Improper Control of Generation of Code ('Code Injection') vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Replace Trusted. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Man in the Middle Attack.0: from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Download of Code Without Integrity Check vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Malicious Software Update.0: from. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Authentication vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Authentication Abuse.0: from V4.0.0 through. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.