The vulnerability arises from insufficient authentication and access control on an internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server. An unauthenticated attacker can invoke internal functions exposed through this interface, potentially leading to remote code execution, unauthorized configuration changes, or other high-impact actions on the policy server. The weakness maps to improper privilege management (CWE‑284) and missing authentication (CWE‑306).

Affected products are Genians, Inc. Genian NAC 5.0.75 LTS, Genian NAC 5.0.85, Genian NAC 5.0.86, Genian ZTNA 6.0.35 LTS, Genian ZTNA 6.0.45, and Genian ZTNA 6.0.46. All listed releases are vulnerable; the vendor recommends updating to the specified revision numbers for each product.

The CVSS score is 9.3, indicating a critical severity. EPSS information is not available, so the likelihood of exploitation cannot be quantified from the data, but the vulnerability is not listed in the CISA KEV catalog. The attack vector is the internal network; an attacker with reach to the internal IPC SOAP endpoint can trigger the flaw without authentication, giving them substantial control over the policy server. While the interface is internal, organizations that expose it accidentally or have compromised internal hosts are at risk.