# CVE-2026-76147: Genian NAC/ZTNA path traversal in agent upgrade feature

Source: https://junglewise.ai/threats/cve-2026-76147-a-path-traversal-zip-slip-vulnerability-caused-by-insufficient  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-76147 · Severity: info · Published 2026-10-01

Genian NAC and ZTNA are network access control and zero-trust network access products that manage device authentication and network policy. A vulnerability in the agent upgrade mechanism allows a privileged attacker to upload a malicious ZIP file that exploits path traversal to write files outside the intended directory, combined with Tomcat's auto-deployment feature, this can lead to remote code execution on the server.

Vendors: [Genian](https://junglewise.ai/threats/vendors/genian).

## Quick answers

**Is CVE-2026-76147 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76147 being exploited in the wild.

**How severe is CVE-2026-76147?** Informational severity, published 1 October 2026.

**Which products and versions are affected?** Genian NAC 4.0.175 (before Revision 148817), 5.0.65 LTS (before Revision 148816), 5.0.75 LTS (before Revision 148815), 5.0.85 Stable (before Revision 148814), 5.0.86 (before Revision 148813); Genian ZTNA 6.0.26 LTS (before Revision 148811), 6.0.35 LTS (before Revision 148810), 6.0.45 Stable (before Revision 148809), 6.0.46 (before Revision 148807).

**Is there a fix for CVE-2026-76147?** Yes: fixed in Genian NAC 4.0.175 (Revision 148817+), 5.0.65 LTS (Revision 148816+), 5.0.75 LTS (Revision 148815+), 5.0.85 Stable (Revision 148814+), 5.0.86 (Revision 148813+); Genian ZTNA 6.0.26 LTS (Revision 148811+), 6.0.35 LTS (Revision 148810+), 6.0.45 Stable (Revision 148809+), 6.0.46 (Revision 148807+). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76147 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-76147?** Check whether you run Genian NAC or Genian ZTNA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Genian NAC 4.0.175 (Revision 148817+), 5.0.65 LTS (Revision 148816+), 5.0.75 LTS (Revision 148815+), 5.0.85 Stable (Revision 148814+), 5.0.86 (Revision 148813+); Genian ZTNA 6.0.26 LTS (Revision 148811+), 6.0.35 LTS (Revision 148810+), 6.0.45 Stable (Revision 148809+), 6.0.46 (Revision 148807+)

## Technical details

The vulnerability is a ZIP Slip path traversal flaw in the agent upgrade feature caused by insufficient authorization and integrity verification of uploaded files. An attacker with high privileges can craft a ZIP archive containing relative paths (e.g., ../../../) to write files into arbitrary locations. When combined with Tomcat's automatic deployment functionality and external proxy path configuration, this allows execution of malicious code on the vulnerable system.

## Affected products

- Genian NAC 4.0.175 (before Revision 148817), 5.0.65 LTS (before Revision 148816), 5.0.75 LTS (before Revision 148815), 5.0.85 Stable (before Revision 148814), 5.0.86 (before Revision 148813)
- Genian ZTNA 6.0.26 LTS (before Revision 148811), 6.0.35 LTS (before Revision 148810), 6.0.45 Stable (before Revision 148809), 6.0.46 (before Revision 148807)

## Timeline

- 2026-07-07: disclosed
- 2026-06-26: patched

## References

- [https://docs.genians.com/release/ko/advisories/GN-SA-2026-001.html](https://docs.genians.com/release/ko/advisories/GN-SA-2026-001.html)
- [https://github.com/genians/security-research/security/advisories/GHSA-c883-w46g-6mg5](https://github.com/genians/security-research/security/advisories/GHSA-c883-w46g-6mg5)

## Related threats

- [Genian NAC/ZTNA unauthorized access to internal IPC endpoint](https://junglewise.ai/threats/cve-2026-76142-insufficient-authentication-and-access-control-on-the-internal)