CVE-2026-16520
Summary
| CVE | CVE-2026-16520 |
|---|---|
| State | PUBLISHED |
| Assigner | FSI |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-21 00:16:31 UTC |
| Updated | 2026-09-03 16:59:26 UTC |
| Description | Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175(Revision 150340); Genian NAC V5.0: from 5.0.0 before 5.0.65 LTS(Revision 150331), from 5.0.0 before 5.0.75 LTS(Revision 150330), from 5.0.0 before 5.0.87 Release Stable(Revision 150329), and from 5.0.0 before 5.0.88(Revision 150328); Genian ZTNA V6.0: from 6.0.0 before 6.0.26 LTS(Revision 150337), from 6.0.0 before 6.0.35 LTS(Revision 150336), from 6.0.0 before 6.0.47 Release Stable(Revision 150334), and from 6.0.0 before 6.0.48(Revision 150333). |
Risk And Classification
Primary CVSS: v4.0 8.7 HIGH from 09832df1-09c1-45b4-8a85-16c601d30feb
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.003860000 probability, percentile 0.318080000 (date 2026-09-07)
Problem Types: CWE-20 | CWE-202 | CWE-20 CWE-20 Improper input validation | CWE-202 CWE-202 Exposure of sensitive information through data queries
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 09832df1-09c1-45b4-8a85-16c601d30feb | Secondary | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
NoneAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Genians | Genian NAC V4.0 | affected 4.0.0 4.0.175(Revision 150340) custom | Not specified |
| CNA | Genians | Genian NAC V5.0 | affected 5.0.0 5.0.65 LTS(Revision 150331) custom | Not specified |
| CNA | Genians | Genian NAC V5.0 | affected 5.0.0 5.0.75 LTS(Revision 150330) custom | Not specified |
| CNA | Genians | Genian NAC V5.0 | affected 5.0.0 5.0.87 Release Stable(Revision 150329) custom | Not specified |
| CNA | Genians | Genian NAC V5.0 | affected 5.0.0 5.0.88(Revision 150328) custom | Not specified |
| CNA | Genians | Genian ZTNA V6.0 | affected 6.0.0 6.0.26 LTS(Revision 150337) custom | Not specified |
| CNA | Genians | Genian ZTNA V6.0 | affected 6.0.0 6.0.35 LTS(Revision 150336) custom | Not specified |
| CNA | Genians | Genian ZTNA V6.0 | affected 6.0.0 6.0.47 Release Stable(Revision 150334) custom | Not specified |
| CNA | Genians | Genian ZTNA V6.0 | affected 6.0.0 6.0.48(Revision 150333) custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| docs.genians.com/release/ko/advisories/GN-SA-2026-003.html | 09832df1-09c1-45b4-8a85-16c601d30feb | docs.genians.com | |
| github.com/genians/security-research/security/advisories/GHSA-f6f5-wx2h-... | 09832df1-09c1-45b4-8a85-16c601d30feb | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: 임동호(D2) (en)
There are currently no legacy QID mappings associated with this CVE.