GZ-SA-2026-004: CWP Authentication - Administrator Authentication Bypass Vulnerability

Date

  • November 2, 2026

CVE ID

  • CVE ID to be announced

CVSS V4.0 score

  • 9.3

Severity

  • Critical

Description

An administrator authorization bypass vulnerability was discovered due to insufficient verification of the authentication process on the Genian ZTNA Captive Web Portal(CWP). We have released a security update to address this vulnerability and strengthen product security. Users running affected versions are advised to update to the fixed version.

Affected Versions

  • Genian ZTNA 6.0.26 LTS Release (Revision 129270 or later and earlier than 151669)

  • Genian ZTNA 6.0.35 LTS Release (Revision 136993 or later and earlier than 151668)

  • Genian ZTNA 6.0.47 Release (Revision 150095 or later and earlier than 151667)

  • Genian ZTNA 6.0.48 Release Stable (Revision 151185 or later and earlier than 151665)

  • Genian ZTNA 6.0.49 Release (Revision 151188 or later and earlier than 151664)

※ NAC V4.0, V5.0 is not affected by this vulnerability.

Resolution

The vulnerability described in this advisory can be resolved by updating to the following versions:

  • Genian ZTNA 6.0.26 LTS Release (Revision 151669 or later)

  • Genian ZTNA 6.0.35 LTS Release (Revision 151668 or later)

  • Genian ZTNA 6.0.47 Release (Revision 151667 or later)

  • Genian ZTNA 6.0.48 Release Stable (Revision 151665 or later)

  • Genian ZTNA 6.0.49 Release (Revision 151664 or later)

Temporary Mitigation

  • In environments where the PassKey feature is not used, access to the feature can be blocked as a temporary mitigation. For detailed instructions, contact the manufacturer's Technical Assistance Center (TAC) or an authorized technical support provider.