CVE-2026-76142
Critical
Description
Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions
SeverityCritical
CVSS9.3
Exploit probability—
ProductGenian NAC 5.0.75 LTS Release
PublishedOct 1, 2026
First seenOct 1, 2026
How to fix
Update
- Genians, Inc Genian NAC 5.0.75 LTS Release148667 or later
- Genians, Inc Genian NAC 5.0.85 Release Stable148666 or later
- Genians, Inc Genian NAC 5.0.86 Release148665 or later
- Genians, Inc Genian ZTNA 6.0.35 LTS Release148672 or later
- Genians, Inc Genian ZTNA 6.0.45 Release Stable148671 or later
- Genians, Inc Genian ZTNA 6.0.46 Release148670 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Genians, Inc Genian NAC 5.0.75 LTS Release | 135823 ≤ v < 148667 | 148667 |
| Genians, Inc Genian NAC 5.0.85 Release Stable | 147181 ≤ v < 148666 | 148666 |
| Genians, Inc Genian NAC 5.0.86 Release | 148018 ≤ v < 148665 | 148665 |
| Genians, Inc Genian ZTNA 6.0.35 LTS Release | 135814 ≤ v < 148672 | 148672 |
| Genians, Inc Genian ZTNA 6.0.45 Release Stable | 147169 ≤ v < 148671 | 148671 |
| Genians, Inc Genian ZTNA 6.0.46 Release | 148028 ≤ v < 148670 | 148670 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.