GN-SA-2026-003: Genian NAC - CWP User Search: Unauthenticated Administrator Credential Disclosure Vulnerability

Date

  • July 21, 2026

CVSS V4.0 score

  • 9.3

Severity

  • Critical

Description

A vulnerability has been discovered in Genian NAC that allows an unauthenticated attacker to obtain administrator credentials by using the CWP User Finder. A security update has been released to remediate this issue and strengthen the product's overall security. Users of the affected versions are advised to update to the latest version.

Affected Versions

  • Genian NAC 4.0.175 Release (Revision below 150340)

  • Genian NAC 5.0.65 LTS Release (Revision below 150331)

  • Genian NAC 5.0.75 LTS Release (Revision below 150330)

  • Genian NAC 5.0.87 Release Stable (Revision below 150329)

  • Genian NAC 5.0.88 Release (Revision below 150328)

  • Genian ZTNA 6.0.26 LTS Release (Revision below 150337)

  • Genian ZTNA 6.0.35 LTS Release (Revision below 150336)

  • Genian ZTNA 6.0.47 Release Stable (Revision below 150334)

  • Genian ZTNA 6.0.48 Release (Revision below 150333)

Solution

The vulnerability covered in this advisory can be resolved by updating to the following versions or later.

  • Genian NAC 4.0.175 Release (Revision 150340 or later)

  • Genian NAC 5.0.65 LTS Release (Revision 150331 or later)

  • Genian NAC 5.0.75 LTS Release (Revision 150330 or later)

  • Genian NAC 5.0.87 Release Stable (Revision 150329 or later)

  • Genian NAC 5.0.88 Release (Revision 150328 or later)

  • Genian ZTNA 6.0.26 LTS Release (Revision 150337 or later)

  • Genian ZTNA 6.0.35 LTS Release (Revision 150336 or later)

  • Genian ZTNA 6.0.47 Release Stable (Revision 150334 or later)

  • Genian ZTNA 6.0.48 Release (Revision 150333 or later)

Workaround

  • None