CVE-2026-16520 - Vulnerability Details

Description

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass.

This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175(Revision 150340);
Genian NAC V5.0: from 5.0.0 before 5.0.65 LTS(Revision 150331), from 5.0.0 before 5.0.75 LTS(Revision 150330), from 5.0.0 before 5.0.87 Release Stable(Revision 150329), and from 5.0.0 before 5.0.88(Revision 150328);
Genian ZTNA V6.0: from 6.0.0 before 6.0.26 LTS(Revision 150337), from 6.0.0 before 6.0.35 LTS(Revision 150336), from 6.0.0 before 6.0.47 Release Stable(Revision 150334), and from 6.0.0 before 6.0.48(Revision 150333).

Published: 2026-08-20

Score: 8.7 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Improper input validation allows attackers to inject arbitrary SQL and bypass authentication checks, enabling unauthorized data access and modification. The vulnerability can lead to full compromise of the data store, exposing sensitive user information and potentially enabling further lateral movement within the network.

Affected Systems

Affects Genians Genian NAC versions 4.0.0 through 4.0.174 (revision 150340) and 5.0.0 through 5.0.87 (revisions 150331‑150328). It also impacts Genians Genian ZTNA versions 6.0.0 through 6.0.47 (revisions 150337‑150333).

Risk and Exploitability

The CVSS score is 8.7, indicating high severity. The EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet; however, the attack vector likely involves data query endpoints that accept user input, making it the responsibility of administrators to apply patches promptly.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Genians

Genian NAC V4.0

unaffected

Version	Status	Constraints
`4.0.0`	affected	< 4.0.175(Revision 150340)

Genians

Genian NAC V5.0

unaffected

Version	Status	Constraints
`5.0.0`	affected	< 5.0.65 LTS(Revision 150331)
`5.0.0`	affected	< 5.0.75 LTS(Revision 150330)
`5.0.0`	affected	< 5.0.87 Release Stable(Revision 150329)
`5.0.0`	affected	< 5.0.88(Revision 150328)

Genians

Genian ZTNA V6.0

unaffected

Version	Status	Constraints
`6.0.0`	affected	< 6.0.26 LTS(Revision 150337)
`6.0.0`	affected	< 6.0.35 LTS(Revision 150336)
`6.0.0`	affected	< 6.0.47 Release Stable(Revision 150334)
`6.0.0`	affected	< 6.0.48(Revision 150333)

No data.

Vendor Product Confidence Versions

Genians

Genian Nac

88%

Version	Status	Scheme	Platform
`[4.0.0,4.0.175(Revision 150340))`	affected	generic	—

Genians

Genian Nac

88%

Version	Status	Scheme	Platform
`[5.0.0,5.0.65 LTS(Revision 150331))`	affected	generic	—
`[5.0.0,5.0.75 LTS(Revision 150330))`	affected	generic	—
`[5.0.0,5.0.87 Release Stable(Revision 150329))`	affected	generic	—
`[5.0.0,5.0.88(Revision 150328))`	affected	generic	—

Genians

Genian Ztna

88%

Version	Status	Scheme	Platform
`[6.0.0,6.0.26 LTS(Revision 150337))`	affected	generic	—
`[6.0.0,6.0.35 LTS(Revision 150336))`	affected	generic	—
`[6.0.0,6.0.47 Release Stable(Revision 150334))`	affected	generic	—
`[6.0.0,6.0.48(Revision 150333))`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest vendor patch for Genian NAC and Genian ZTNA as published in the official advisory.
Isolate the affected systems from critical networks and limit their exposure until a patch is applied.
Configure all applications that interact with the database to use parameterized queries and strict input validation to prevent SQL injection.
Implement logging and monitoring on data query endpoints to detect unusual activity and potential exploitation attempts.

Generated by OpenCVE AI on August 21, 2026 at 02:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00386.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://docs.genians.com/release/ko/advisories/GN-SA-2026-003.html
https://github.com/genians/security-research/security/advisories/GHSA-f6f5-wx2h-ccfw

History

Fri, 21 Aug 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 21 Aug 2026 13:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Genians Genians genian Nac Genians genian Ztna
Vendors & Products		Genians Genians genian Nac Genians genian Ztna

Fri, 21 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Description		Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175(Revision 150340); Genian NAC V5.0: from 5.0.0 before 5.0.65 LTS(Revision 150331), from 5.0.0 before 5.0.75 LTS(Revision 150330), from 5.0.0 before 5.0.87 Release Stable(Revision 150329), and from 5.0.0 before 5.0.88(Revision 150328); Genian ZTNA V6.0: from 6.0.0 before 6.0.26 LTS(Revision 150337), from 6.0.0 before 6.0.35 LTS(Revision 150336), from 6.0.0 before 6.0.47 Release Stable(Revision 150334), and from 6.0.0 before 6.0.48(Revision 150333).
Weaknesses		CWE-20 CWE-202
References		https://docs.genians.com/release/ko/advisories/GN-SA-2026-003.html https://github.com/genians/security-research/security/advisories/GHSA-f6f5-wx2h-ccfw
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`

Subscriptions

Genians Genian Nac Genian Ztna

MITRE

Status: PUBLISHED

Assigner: FSI

Published: 2026-08-20T23:57:34.475Z

Updated: 2026-08-21T20:08:37.703Z

Reserved: 2026-07-22T01:19:22.001Z

Link: CVE-2026-16520

Vulnrichment

Updated: 2026-08-21T20:06:20.380Z

NVD

Status : Deferred

Published: 2026-08-21T00:16:31.623

Modified: 2026-09-03T16:59:26.287

Link: CVE-2026-16520

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-21T13:00:13Z

Weaknesses

CWE-20
Improper Input Validation
CWE-202
Exposure of Sensitive Information Through Data Queries

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object