GN-SA-2026-004: CWP Authentication - Administrator Authentication Bypass Vulnerablility

Date

November 2, 2026

CVE ID

CVE ID to be announced

CVSS V4.0 score

9.3

Severity

Critical

Description

An administrator authorization bypass vulnerability was discovered due to insufficient verification of the authentication process on the Genian ZTNA Captive Web Portal(CWP). We have released a security update to address this vulnerability and strengthen product security. Users running affected versions are advised to update to the fixed version.

Affected Versions

Genian ZTNA 6.0.26 LTS Release (Revision 129270 or later and earlier than 151669)
Genian ZTNA 6.0.35 LTS Release (Revision 136993 or later and earlier than 151668)
Genian ZTNA 6.0.47 Release (Revision 150095 or later and earlier than 151667)
Genian ZTNA 6.0.48 Release Stable (Revision 151185 or later and earlier than 151665)
Genian ZTNA 6.0.49 Release (Revision 151188 or later and earlier than 151664)

※ NAC V4.0, V5.0 is not affected by this vulnerability.

Resolution

The vulnerability described in this advisory can be resolved by updating to the following versions:

Genian ZTNA 6.0.26 LTS Release (Revision 151669 or later)
Genian ZTNA 6.0.35 LTS Release (Revision 151668 or later)
Genian ZTNA 6.0.47 Release (Revision 151667 or later)
Genian ZTNA 6.0.48 Release Stable (Revision 151665 or later)
Genian ZTNA 6.0.49 Release (Revision 151664 or later)

Temporary Mitigation

In environments where the PassKey feature is not used, access to the feature can be blocked as a temporary mitigation. For detailed instructions, contact the manufacturer's Technical Assistance Center (TAC) or an authorized technical support provider.