Genian NAC CVE-2026-76142

Exploitation requires network reachability to the Genian NAC/ZTNA policy server's internal IPC SOAP endpoint - an interface the vendor intended to be internal-only - after which no authentication or access-control check is enforced (PR:N/UI:N/AC:L). The primary limiting factor is network exposure: in deployments where the management/IPC plane of the policy server is properly segmented or firewalled off from untrusted networks, the endpoint is not reachable and the attack cannot proceed; conversely, flat networks or an externally exposed policy server make it directly exploitable. Affected builds are Genian NAC 5.0.75 LTS / 5.0.85 Stable / 5.0.86 and Genian ZTNA 6.0.35 LTS / 6.0.45 Stable / 6.0.46.

All signals point to a high-priority defect against affected deployments. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated invocation of privileged internal functions, with high integrity and availability impact to both the vulnerable system (VI:H/VA:H) and subsequent systems (SI:H/SA:H), yielding a 9.3 Critical score - consistent with CWE-284 improper access control on a security-enforcement appliance. No EPSS probability was provided, no CISA KEV listing is present, and no public exploit code is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk rating therefore rests on intrinsic severity rather than observed in-the-wild activity. One important tension: the endpoint is explicitly described as 'internal-only IPC SOAP,' which means the PR:N/AV:N rating assumes an attacker can actually reach an interface the vendor intended never to be externally exposed. Where the policy server management/IPC plane is properly segmented, real-world reachability (and thus real-world risk) is materially lower than the raw 9.3 suggests; where it is flat or exposed, this is a genuine unauthenticated-compromise priority. The report originates from KrCERT and a coordinated Genians GitHub security advisory, lending credibility to the technical details.

An attacker with network access to the Genian NAC/ZTNA policy server's internal IPC plane sends crafted SOAP requests to the IPC endpoint, which performs no (or insufficient) authentication and access-control checks. The attacker thereby invokes internal, privileged functions directly, manipulating NAC/ZTNA policy state and server operation (high integrity/availability impact) without any credentials. No public proof-of-concept is referenced, but the attack complexity is low (AC:L) once the endpoint is reachable.