A path traversal (ZIP Slip) flaw in the Genian NAC/ZTNA agent upgrade feature allows a remote attacker to upload a crafted archive that writes files outside the expected directory, resulting in arbitrary code execution. The weakness stems from insufficient authorization and integrity checks, as reflected by the related CWE identifiers for path traversal and missing access controls. The vulnerability could compromise the confidentiality, integrity, and availability of the affected system if exploited.

The affected products are Genians, Inc Genian NAC versions 4.0.175, 5.0.65 LTS, 5.0.75 LTS, 5.0.85 Stable, and 5.0.86, as well as Genian ZTNA versions 6.0.26 LTS, 6.0.35 LTS, 6.0.45 Stable, and 6.0.46. All listed releases must be updated to the specified revision numbers or later: Revision 148817 or later for NAC 4.0.175; Revision 148816 or later for NAC 5.0.65 LTS; Revision 148815 or later for NAC 5.0.75 LTS; Revision 148814 or later for NAC 5.0.85 Stable; Revision 148813 or later for NAC 5.0.86; Revision 148811 or later for ZTNA 6.0.26 LTS; Revision 148810 or later for ZTNA 6.0.35 LTS; Revision 148809 or later for ZTNA 6.0.45 Stable; Revision 148807 or later for ZTNA 6.0.46.

The CVSS score of 5.9 indicates moderate complexity for exploitation; the EPSS score is not available so the current probability of exploitation remains unknown. Because the flaw allows remote code execution via the upgrade channel, an attacker who can trigger an agent upgrade from a non‑trusted source could gain control over the system without requiring additional privileged credentials. The vulnerability is not listed in CISA's KEV catalog, which suggests no publicly known active exploitation, but the exposure warrants prompt remediation.