{"id":"CVE-2026-76142","state":"PUBLISHED","title":"Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface","description":"Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions","publishedAt":"2026-10-01T04:53:35.730Z","updatedAt":"2026-10-01T15:58:20.134Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H","source":"krcert"},"assigner":"krcert","products":["Genians, Inc Genian NAC 5.0.75 LTS Release","Genians, Inc Genian NAC 5.0.85 Release Stable","Genians, Inc Genian NAC 5.0.86 Release","Genians, Inc Genian ZTNA 6.0.35 LTS Release","Genians, Inc Genian ZTNA 6.0.45 Release Stable","Genians, Inc Genian ZTNA 6.0.46 Release"],"affected":[{"vendor":"Genians, Inc","product":"Genian NAC 5.0.75 LTS Release","defaultStatus":"unaffected","versions":[{"version":"135823","status":"affected","lessThan":"148667","versionType":"custom"}]},{"vendor":"Genians, Inc","product":"Genian NAC 5.0.85 Release Stable","defaultStatus":"unaffected","versions":[{"version":"147181","status":"affected","lessThan":"148666","versionType":"custom"}]},{"vendor":"Genians, Inc","product":"Genian NAC 5.0.86 Release","defaultStatus":"unaffected","versions":[{"version":"148018","status":"affected","lessThan":"148665","versionType":"custom"}]},{"vendor":"Genians, Inc","product":"Genian ZTNA 6.0.35 LTS Release","defaultStatus":"unaffected","versions":[{"version":"135814","status":"affected","lessThan":"148672","versionType":"custom"}]},{"vendor":"Genians, Inc","product":"Genian ZTNA 6.0.45 Release Stable","defaultStatus":"unaffected","versions":[{"version":"147169","status":"affected","lessThan":"148671","versionType":"custom"}]},{"vendor":"Genians, Inc","product":"Genian ZTNA 6.0.46 Release","defaultStatus":"unaffected","versions":[{"version":"148028","status":"affected","lessThan":"148670","versionType":"custom"}]}],"references":["https://docs.genians.com/release/ko/advisories/GN-SA-2026-002.html","https://github.com/genians/security-research/security/advisories/GHSA-qf3p-2jpg-3h95"],"weaknesses":["CWE-284","CWE-306"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/76xxx/CVE-2026-76142.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-76142","state":"PUBLISHED","datePublished":"2026-10-01T04:53:35.730Z","dateUpdated":"2026-10-01T15:58:20.134Z","assignerShortName":"krcert","assignerOrgId":"cdd7a122-0fae-4202-8d86-14efbacc2863","dateReserved":"2026-08-19T04:13:00.870Z"},"containers":{"cna":{"title":"Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface","descriptions":[{"lang":"en","value":"Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions"}],"affected":[{"vendor":"Genians, Inc","product":"Genian NAC 5.0.75 LTS Release","defaultStatus":"unaffected","versions":[{"version":"135823","status":"affected","lessThan":"148667","versionType":"custom"}]},{"vendor":"Genians, Inc","product":"Genian NAC 5.0.85 Release Stable","defaultStatus":"unaffected","versions":[{"version":"147181","status":"affected","lessThan":"148666","versionType":"custom"}]},{"vendor":"Genians, Inc","product":"Genian NAC 5.0.86 Release","defaultStatus":"unaffected","versions":[{"version":"148018","status":"affected","lessThan":"148665","versionType":"custom"}]},{"vendor":"Genians, Inc","product":"Genian ZTNA 6.0.35 LTS Release","defaultStatus":"unaffected","versions":[{"version":"135814","status":"affected","lessThan":"148672","versionType":"custom"}]},{"vendor":"Genians, Inc","product":"Genian ZTNA 6.0.45 Release Stable","defaultStatus":"unaffected","versions":[{"version":"147169","status":"affected","lessThan":"148671","versionType":"custom"}]},{"vendor":"Genians, Inc","product":"Genian ZTNA 6.0.46 Release","defaultStatus":"unaffected","versions":[{"version":"148028","status":"affected","lessThan":"148670","versionType":"custom"}]}],"references":[{"url":"https://docs.genians.com/release/ko/advisories/GN-SA-2026-002.html"},{"url":"https://github.com/genians/security-research/security/advisories/GHSA-qf3p-2jpg-3h95"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","lang":"en","description":"CWE-284 Improper Access Control","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-306","lang":"en","description":"CWE-306 Missing Authentication for Critical Function","type":"CWE"}]}],"providerMetadata":{"shortName":"krcert","orgId":"cdd7a122-0fae-4202-8d86-14efbacc2863","dateUpdated":"2026-10-01T04:53:35.730Z"},"impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115"}]}],"solutions":[{"lang":"en","value":"Genian NAC 5.0.75 LTS Release: update to Revision 148667 or later.\n\n\n\nGenian NAC 5.0.85 Release Stable: update to Revision 148666 or later.\n\n\n\nGenian NAC 5.0.86 Release: update to Revision 148665 or later.\n\n\n\nGenian ZTNA 6.0.35 LTS Release: update to Revision 148672 or later.\n\n\n\nGenian ZTNA 6.0.45 Release Stable: update to Revision 148671 or later.\n\n\n\nGenian ZTNA 6.0.46 Release: update to Revision 148670 or later.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Genian NAC 5.0.75 LTS Release: update to Revision 148667 or later.</p><p>Genian NAC 5.0.85 Release Stable: update to Revision 148666 or later.</p><p>Genian NAC 5.0.86 Release: update to Revision 148665 or later.</p><p>Genian ZTNA 6.0.35 LTS Release: update to Revision 148672 or later.</p><p>Genian ZTNA 6.0.45 Release Stable: update to Revision 148671 or later.</p><p>Genian ZTNA 6.0.46 Release: update to Revision 148670 or later.</p>"}]}],"credits":[{"lang":"en","value":"segyeong","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-01T15:58:10.619392Z","id":"CVE-2026-76142","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-01T15:58:20.134Z"}}]}}}