All vulnerabilities
CVE-2026-76147GHSA-c883-w46g-6mg5

Genians, Inc Genian NAC/ZTNA Remote Code Execution

Genians, Inc Genian NAC 4.0.175 Release
Open in ThreatlineRecord JSON
CVSS
5.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.40%Chance of exploitation activity in the next 30 days, higher than 33% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in148817Also 148816, 148815 and 6 moreCVE List
Published1 Oct 2026Updated 1 Oct 2026CVE List

What fixes it

  • 148817Genian NAC 4.0.175 ReleaseCVE List
  • 148816Genian NAC 5.0.65 LTS ReleaseCVE List
  • 148815Genian NAC 5.0.75 LTS ReleaseCVE List
  • 148814Genian NAC 5.0.85 Release StableCVE List
  • 148813Genian NAC 5.0.86 ReleaseCVE List
  • 148811Genian ZTNA 6.0.26 LTS ReleaseCVE List
Show all 9 fixed versions
  • 148810Genian ZTNA 6.0.35 LTS ReleaseCVE List
  • 148809Genian ZTNA 6.0.45 Release StableCVE List
  • 148807Genian ZTNA 6.0.46 ReleaseCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code

Text from CVE List

Affected versions 9

  • Genian NAC 4.0.175 Releaseaffected: all versions before 148817CVE List
  • Genian NAC 5.0.65 LTS Releaseaffected: all versions before 148816CVE List
  • Genian NAC 5.0.75 LTS Releaseaffected: all versions before 148815CVE List
  • Genian NAC 5.0.85 Release Stableaffected: all versions before 148814CVE List
  • Genian NAC 5.0.86 Releaseaffected: all versions before 148813CVE List
  • Genian ZTNA 6.0.26 LTS Releaseaffected: all versions before 148811CVE List
  • Genian ZTNA 6.0.35 LTS Releaseaffected: all versions before 148810CVE List
  • Genian ZTNA 6.0.45 Release Stableaffected: all versions before 148809CVE List
  • Genian ZTNA 6.0.46 Releaseaffected: all versions before 148807CVE List

References 2