GN-SA-2026-003: Genian NAC - CWP User Search: Unauthenticated Administrator Credential Disclosure Vulnerability

Date

July 21, 2026

CVSS V4.0 score

9.3

Severity

Critical

Description

A vulnerability has been discovered in Genian NAC that allows an unauthenticated attacker to obtain administrator credentials by using the CWP User Finder. A security update has been released to remediate this issue and strengthen the product's overall security. Users of the affected versions are advised to update to the latest version.

Affected Versions

Genian NAC 4.0.175 Release (Revision below 150340)
Genian NAC 5.0.65 LTS Release (Revision below 150331)
Genian NAC 5.0.75 LTS Release (Revision below 150330)
Genian NAC 5.0.87 Release Stable (Revision below 150329)
Genian NAC 5.0.88 Release (Revision below 150328)
Genian ZTNA 6.0.26 LTS Release (Revision below 150337)
Genian ZTNA 6.0.35 LTS Release (Revision below 150336)
Genian ZTNA 6.0.47 Release Stable (Revision below 150334)
Genian ZTNA 6.0.48 Release (Revision below 150333)

Solution

The vulnerability covered in this advisory can be resolved by updating to the following versions or later.

Genian NAC 4.0.175 Release (Revision 150340 or later)
Genian NAC 5.0.65 LTS Release (Revision 150331 or later)
Genian NAC 5.0.75 LTS Release (Revision 150330 or later)
Genian NAC 5.0.87 Release Stable (Revision 150329 or later)
Genian NAC 5.0.88 Release (Revision 150328 or later)
Genian ZTNA 6.0.26 LTS Release (Revision 150337 or later)
Genian ZTNA 6.0.35 LTS Release (Revision 150336 or later)
Genian ZTNA 6.0.47 Release Stable (Revision 150334 or later)
Genian ZTNA 6.0.48 Release (Revision 150333 or later)

Workaround

None