CVE-2026-16520: CWE-20 Improper input validation in Genians Genian NAC V4.0
Description
CVE-2026-16520 is a high-severity vulnerability affecting multiple versions of Genians Genian NAC and Genian ZTNA products. It involves improper input validation and exposure of sensitive information through data queries, leading to SQL Injection and authentication bypass. The affected versions span Genian NAC V4.0, V5.0, and Genian ZTNA V6.0, with specific version ranges detailed. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant risk if exploited.
CVSS v4.0
Score 8.7high
Affected software
Genians
Genian NAC V4.0
Genians
Genian NAC V5.0
Genians
Genian ZTNA V6.0
pkg:github/genians/genian-nacpkg:github/genians/genian-ztnaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Genians Genian NAC V4.0, V5.0, and Genian ZTNA V6.0 arises from improper input validation and exposure of sensitive information through data queries. These flaws allow attackers to perform SQL Injection attacks and bypass authentication mechanisms. The affected versions include Genian NAC from 4.0.0 up to but not including 4.0.175, various subranges in 5.0.x, and Genian ZTNA from 6.0.0 up to but not including several patch versions up to 6.0.48. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.
Potential Impact
Successful exploitation can lead to unauthorized access via authentication bypass and compromise of sensitive information through SQL Injection. This can result in data breaches and unauthorized control over the affected systems. The high CVSS score reflects the critical nature of these impacts.
Mitigation Recommendations
No explicit patch or remediation links are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes are applied, restrict network access to the affected services and monitor for unusual activity related to authentication and database queries.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- FSI
- Date Reserved
- 2026-07-22T01:19:22.001Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a879dd3acd9273b4958d0f7
Added to database: 08/21/2026, 00:37:39 UTC
Last enriched: 09/10/2026, 19:20:59 UTC
Last updated: 10/05/2026, 06:48:14 UTC
Views: 105
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.