Genian Ssl Pns Xenics Auther
Monthly
OS command injection in Genian SSL PNS (Xenics Auther) lets a remote attacker execute arbitrary operating-system commands on the host, with the only documented prerequisite being knowledge of a valid client access ID rather than the matching password. The flaw is tracked as CVE-2026-76146 (CWE-78) and carries a CVSS 4.0 base score of 8.4, where the AT:P attack-requirement metric encodes that access-ID precondition while PR:N/UI:N confirm no credentials and no user interaction are needed. Public reporting so far is limited to the vendor's own security-research advisory (GHSA-2597-v98f-frhj) issued via KR-CERT, there is no CISA KEV entry, and no public exploit code has been identified at time of analysis, so this is a genuine high-impact exposure without confirmed active exploitation.
OS command injection in Genian SSL PNS (Xenics Auther) lets a remote attacker execute arbitrary operating-system commands on the host, with the only documented prerequisite being knowledge of a valid client access ID rather than the matching password. The flaw is tracked as CVE-2026-76146 (CWE-78) and carries a CVSS 4.0 base score of 8.4, where the AT:P attack-requirement metric encodes that access-ID precondition while PR:N/UI:N confirm no credentials and no user interaction are needed. Public reporting so far is limited to the vendor's own security-research advisory (GHSA-2597-v98f-frhj) issued via KR-CERT, there is no CISA KEV entry, and no public exploit code has been identified at time of analysis, so this is a genuine high-impact exposure without confirmed active exploitation.