CVE-2026-76147

Genians, Inc Genian NAC/ZTNA Remote Code Execution

MEDIUM

5.9

CVSS Score

Published: October 1, 2026 at 04:53 AM UTC

Updated: October 1, 2026 at 04:17 PM UTC

2 products affected across 1 vendorGenian NacGenian ZTNA

Using Genian NAC 4.0.175 Release by Genians, Inc?

Get instant alerts when new vulnerabilities affect Genian NAC 4.0.175 Release - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.9

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Genian Nac · Genians

60%

v < 148813v < 148814v < 148815v < 148816v < 148817

Affected range stops below 148813, so it looks safe — our inference, not a vendor statement

Affected range stops below 148814, so it looks safe — our inference, not a vendor statement

Affected range stops below 148815, so it looks safe — our inference, not a vendor statement

Affected range stops below 148816, so it looks safe — our inference, not a vendor statement

Affected range stops below 148817, so it looks safe — our inference, not a vendor statement

Genian ZTNA · Genians

60%

v < 148807v < 148809v < 148810v < 148811

Affected range stops below 148807, so it looks safe — our inference, not a vendor statement

Affected range stops below 148809, so it looks safe — our inference, not a vendor statement

Affected range stops below 148810, so it looks safe — our inference, not a vendor statement

Affected range stops below 148811, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (2)

Source: cverecord

https://docs.genians.com/release/ko/advisories/GN-SA-2026-001.html

Source: cverecord

https://github.com/genians/security-research/security/advisories/GHSA-c883-w46g-6mg5

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.9MEDIUMkrcert

Vector?

Quick Info

StatusDEFERRED

CWE

CWE-862CWE-807CWE-22

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card