Skip to content
OpenAdvisories
Critical · 9.3 Public exploit CVE-2026-76142 EUVD-2026-90484GHSA-8pg5-29m6-59f2

Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface

Published Oct 1, 2026 · Updated Oct 1, 2026 · Assigned by krcert

Vendor: Genians Product: Genian NAC 5.0.75 LTS Release Product: Genian NAC 5.0.85 Release Stable Product: Genian NAC 5.0.86 Release Product: Genian ZTNA 6.0.35 LTS Release Product: Genian ZTNA 6.0.45 Release Stable Product: Genian ZTNA 6.0.46 Release

Description

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions

Affected products

VendorProductAffectedFixed
Genians Genian NAC 5.0.75 LTS Release 135823 – < 148667 148667
Genians Genian NAC 5.0.85 Release Stable 147181 – < 148666 148666
Genians Genian NAC 5.0.86 Release 148018 – < 148665 148665
Genians Genian ZTNA 6.0.35 LTS Release 135814 – < 148672 148672
Genians Genian ZTNA 6.0.45 Release Stable 147169 – < 148671 148671
Genians Genian ZTNA 6.0.46 Release 148028 – < 148670 148670

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • MalHyuk/CVE-2026-76142 ★ 0 · Nov 5, 2026

    CVE-2026-76142 — Genian NAC/ZTNA pre-auth internal IPC routing flaw (gnrpcsvc), CVSS 9.3, fixed in build 148665+

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References