CVE-2026-76147— Genians, Inc Genian NAC/ZTNA Remote Code Execution
Quick assessment
Affected
Genians, Inc Genian NAC 4.0.175 Release
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
由于 Genian NAC/ZTNA 的代理升级功能中存在授权和完整性验证不足，导致路径遍历（ZIP Slip）漏洞，允许远程攻击者执行任意代码。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76147
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Genians, Inc Genian NAC/ZTNA Remote Code Execution
Source: CVE Program / CVE List V5
Vulnerability Description
A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Genians, Inc | Genian NAC 4.0.175 Release | 0 ~ 148817 | - |
|
| Genians, Inc | Genian NAC 5.0.65 LTS Release | 0 ~ 148816 | - |
|
| Genians, Inc | Genian NAC 5.0.75 LTS Release | 0 ~ 148815 | - |
|
| Genians, Inc | Genian NAC 5.0.85 Release Stable | 0 ~ 148814 | - |
|
| Genians, Inc | Genian NAC 5.0.86 Release | 0 ~ 148813 | - |
|
| Genians, Inc | Genian ZTNA 6.0.26 LTS Release | 0 ~ 148811 | - |
|
| Genians, Inc | Genian ZTNA 6.0.35 LTS Release | 0 ~ 148810 | - |
|
| Genians, Inc | Genian ZTNA 6.0.45 Release Stable | 0 ~ 148809 | - |
|
| Genians, Inc | Genian ZTNA 6.0.46 Release | 0 ~ 148807 | - |
|
II. Public POCs for CVE-2026-76147
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76147
请登录查看更多情报信息。
Other References for CVE-2026-76147 (2)
Same Patch Batch · Genians, Inc · 2026-10-01 · 6 CVEs total
| CVE-2026-76142 | 9.3 CRITICAL | Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface |
| CVE-2026-76146 | 8.4 HIGH | Genians, Inc Genian SSL PNS OS Command Injection |
| CVE-2026-76145 | 7.5 HIGH | Genians, Inc Genian SSL PNS Improper Privilege Management |
| CVE-2026-76143 | 7.3 HIGH | Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass |
| CVE-2026-76144 | 1.8 LOW | Genians, Inc Genian SSL PNS Unrestricted File Upload |
IV. Related Vulnerabilities
Same vendor: Genians, Inc
-
CVE-2026-76146
Genians, Inc Genian SSL PNS OS Command Injection -
CVE-2026-76145
Genians, Inc Genian SSL PNS Improper Privilege Management -
CVE-2026-76143
Genians, Inc Genian SSL PNS Multi Factor Authentication Bypa -
CVE-2026-76144
Genians, Inc Genian SSL PNS Unrestricted File Upload -
CVE-2026-76142
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the
Same weakness: CWE-862
-
CVE-2026-103274
Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read -
CVE-2026-103269
Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Exc -
CVE-2026-103268
Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Res -
CVE-2026-103260
n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass v -
CVE-2026-103251
n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Vali
V. Comments for CVE-2026-76147
No comments yet