GN-SA-2026-002: Genian NAC - Unauthorized Access to Internal Interface Vulnerability

Date

July 07, 2026

CVSS V4.0 score

9.3

Severity

Critical

Description

A vulnerability was discovered in which an internal IPC endpoint of the Genian NAC Policy Server could be called externally without authentication. A security update has been released along with remediation to strengthen product security. Users of affected versions are advised to update to the latest version.

Affected Versions

Genian NAC 5.0.86 Release (Revision 148018 or later ~ below 148665)
Genian NAC 5.0.85 Release Stable (Revision 147181 or later ~ below 148666)
Genian NAC 5.0.75 LTS Release (Revision 135823 or later ~ below 148667)
Genian ZTNA 6.0.46 Release (Revision 148028 or later ~ below 148670)
Genian ZTNA 6.0.45 Release Stable (Revision 147169 or later ~ below 148671)
Genian ZTNA 6.0.35 Release (Revision 135814 or later ~ below 148672)

Solution

The vulnerabilities included in this advisory can be resolved by updating to the following versions:

Genian NAC 5.0.86 Release (Revision 148665 or later)
Genian NAC 5.0.85 Release Stable (Revision 148666 or later)
Genian NAC 5.0.75 LTS Release (Revision 148667 or later)
Genian ZTNA 6.0.46 Release (Revision 148670 or later)
Genian ZTNA 6.0.45 Release Stable (Revision 148671 or later)
Genian ZTNA 6.0.35 Release (Revision 148672 or later)

Workaround

None