Vulnerability · Published Oct 1, 2026 · Assigned by krcert
CVE-2026-76142Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface
Critical 9.3
In plain English
A critical-severity improper access control in Genian NAC 5.0.75 LTS Release from Genians, Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.3%top 73.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Genians, Inc | Genian NAC 5.0.75 LTS Release | 135823 – before 148667 |
| Genians, Inc | Genian NAC 5.0.85 Release Stable | 147181 – before 148666 |
| Genians, Inc | Genian NAC 5.0.86 Release | 148018 – before 148665 |
| Genians, Inc | Genian ZTNA 6.0.35 LTS Release | 135814 – before 148672 |
| Genians, Inc | Genian ZTNA 6.0.45 Release Stable | 147169 – before 148671 |
| Genians, Inc | Genian ZTNA 6.0.46 Release | 148028 – before 148670 |
Weakness: CWE-284, CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H