Genian NAC/ZTNA: Improper access control on internal IPC endpoint

Summary

The internal-only IPC SOAP endpoint of the Genian NAC and ZTNA policy server lacks sufficient authentication and access control. An unauthenticated attacker who can reach the service can invoke internal functions, which the vendor rates as critical (CVSS 4.0 9.3). According to the vendor, the exposure requires the service (port 9999, gnrpcsvc) to be published to untrusted networks through a reverse proxy such as Apache ProxyPass; a default internal deployment is not described as affected.

Affected

• Genian NAC 5.0.75 LTS: revision 135823 up to, but not including, 148667
• Genian NAC 5.0.85 Release Stable: revision 147181 up to, but not including, 148666
• Genian NAC 5.0.86 Release: revision 148018 up to, but not including, 148665
• Genian ZTNA 6.0.35 LTS: revision 135814 up to, but not including, 148672
• Genian ZTNA 6.0.45 Release Stable: revision 147169 up to, but not including, 148671
• Genian ZTNA 6.0.46 Release: revision 148028 up to, but not including, 148670
• Genian NAC 4.0.x: Unknown.

Fixed in

• Genian NAC 5.0.86: revision 148665 or later
• Genian NAC 5.0.85 Release Stable: revision 148666 or later
• Genian NAC 5.0.75 LTS: revision 148667 or later
• Genian ZTNA 6.0.46: revision 148670 or later
• Genian ZTNA 6.0.45 Release Stable: revision 148671 or later
• Genian ZTNA 6.0.35 LTS: revision 148672 or later

Note: fixed builds are identified by revision number; check the revision on each appliance.

Workaround

• Vendor-stated workaround: Unknown.
• Practical mitigation (not from the vendor): make sure no reverse proxy (for example Apache ProxyPass) publishes the affected service port to untrusted networks, and block it at the firewall until patched.
• Restrict management and service interfaces to internal admin networks.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No public proof of concept or in-the-wild exploitation found in the research; KEV status not verified.
• EPSS 0.00333 (third-party aggregator).

Our recommendation

• Inventory all Genian NAC and ZTNA policy servers and record product branch and revision.
• Compare each revision with the affected ranges and update to the fixed revision.
• Check reverse proxy and firewall rules for any exposure of the affected service and remove it.
• Review logs for unexpected requests to the service, since the exposure window may predate the patch.
• Confirm with Genians whether Genian NAC 4.0.x is affected.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GN-SA-2026-002 Security Advisory (Genians documentation) docs.genians.com
• GHSA-qf3p-2jpg-3h95 (GitHub Security Advisory) github.com
• Vulners VulnRichment CVE-2026-76142 vulners.com
• OpenCVE CVE-2026-76142 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:45.