Multiple versions of Genian NAC and ZTNA are affected by input validation flaws that expose sensitive information to unauthenticated attackers.

The software contains vulnerabilities related to improper input validation (CWE-20) and the exposure of sensitive information through data queries (CWE-202). These flaws allow an unauthenticated attacker to bypass security controls and access sensitive system information.

The exposure of sensitive information via data queries can provide an attacker with critical network topology, device identities, or administrative details. Given the CVSS score of 8.7, this is a high-severity issue that could facilitate lateral movement or more complex attacks against the internal network. Unauthorized access to network management data undermines the entire security posture of the affected NAC solution.

Immediate Action: Apply the vendor-provided updates immediately, ensuring that Genian NAC and ZTNA are upgraded to the versions specified in the official security advisory (GN-SA-2026-003).

Proactive Monitoring: Monitor network traffic for unusual query patterns directed at the NAC management console or database interfaces.

Compensating Controls: Restrict management interface access to authorized internal management networks and use VPNs or zero-trust access controls to prevent external exposure.

Public Exploit Available: Unknown

Administrators must treat this vulnerability with high priority due to the unauthenticated access vector. Review the official Genians security advisory to identify the exact patch level required for your specific deployment and apply the updates during the next maintenance window.