GN-SA-2026-001: Genian NAC - Remote Code Execution (RCE) Vulnerability

Date

  • July 07, 2026

CVSS V4.0 score

  • 7.7

Severity

  • High

Description

A ZIP Slip-based Remote Code Execution (RCE) vulnerability, caused by insufficient validation in the agent upgrade feature, has been discovered, and a security update has been released. Users of affected versions are advised to update to the latest version.

  • Remote Code Execution (RCE) via ZIP Slip and missing permission validation in AgentUpgrade (CVE-2026-XXXX)

Affected Versions

  • Genian NAC 4.0.175 Release (below Revision 148817)

  • Genian NAC 5.0.65 LTS Release (below Revision 148816)

  • Genian NAC 5.0.75 LTS Release (below Revision 148815)

  • Genian NAC 5.0.85 Release (below Revision 148814)

  • Genian NAC 5.0.86 Release (below Revision 148813)

  • Genian NAC 6.0.26 LTS Release (below Revision 148811)

  • Genian NAC 6.0.35 LTS Release (below Revision 148810)

  • Genian NAC 6.0.45 Release (below Revision 148809)

  • Genian NAC 6.0.46 Release (below Revision 148807)

Solution

The vulnerabilities included in this advisory can be resolved by updating to the following versions:

  • Genian NAC 4.0.175 Release (Revision 148817 or later)

  • Genian NAC 5.0.65 LTS Release (Revision 148816 or later)

  • Genian NAC 5.0.75 LTS Release (Revision 148815 or later)

  • Genian NAC 5.0.85 Release (Revision 148814 or later)

  • Genian NAC 5.0.86 Release (Revision 148813 or later)

  • Genian NAC 6.0.26 LTS Release (Revision 148811 or later)

  • Genian NAC 6.0.35 LTS Release (Revision 148810 or later)

  • Genian NAC 6.0.45 Release (Revision 148809 or later)

  • Genian NAC 6.0.46 Release (Revision 148807 or later)

Workaround

  • None