GN-SA-2026-002: Genian NAC - Unauthorized Access to Internal Interface Vulnerability

Date

  • July 07, 2026

CVSS V4.0 score

  • 9.3

Severity

  • Critical

Description

A vulnerability was discovered in which an internal IPC endpoint of the Genian NAC Policy Server could be called externally without authentication. A security update has been released along with remediation to strengthen product security. Users of affected versions are advised to update to the latest version.

Affected Versions

  • Genian NAC 5.0.86 Release (Revision 148018 or later ~ below 148665)

  • Genian NAC 5.0.85 Release Stable (Revision 147181 or later ~ below 148666)

  • Genian NAC 5.0.75 LTS Release (Revision 135823 or later ~ below 148667)

  • Genian NAC 6.0.46 Release (Revision 148028 or later ~ below 148670)

  • Genian NAC 6.0.45 Release Stable (Revision 147169 or later ~ below 148671)

  • Genian NAC 6.0.35 Release (Revision 135814 or later ~ below 148672)

Solution

The vulnerabilities included in this advisory can be resolved by updating to the following versions:

  • Genian NAC 5.0.86 Release (Revision 148665 or later)

  • Genian NAC 5.0.85 Release Stable (Revision 148666 or later)

  • Genian NAC 5.0.75 LTS Release (Revision 148667 or later)

  • Genian NAC 6.0.46 Release (Revision 148670 or later)

  • Genian NAC 6.0.45 Release Stable (Revision 148671 or later)

  • Genian NAC 6.0.35 Release (Revision 148672 or later)

Workaround

  • None