Insufficient authentication and access control on the internal-only IPC SOAP endpoint of…

Genians Genian NAC 5.0.75 LTS Release

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions

First seen: 5 Nov 2026
Last update: 5 Nov 2026, 23:17 UTC
Versions per the CVE record from krcert, not the vendor: Genian NAC 5.0.75 LTS Release 148667
Genian NAC 5.0.85 Release Stable 148666
Genian NAC 5.0.86 Release 148665
Genian ZTNA 6.0.35 LTS Release 148672
Genian ZTNA 6.0.45 Release Stable 148671
Genian ZTNA 6.0.46 Release 148670
Identifiers: CVE-2026-76142
CVSS: 9.3
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Insufficient authentication and access control on the internal-only IPC SOAP endpoint of…
Severity: critical. Patch status: fix status unknown.
Affected: Genians Genian NAC 5.0.75 LTS Release
Versions per the CVE record from krcert, not the vendor: Genian NAC 5.0.75 LTS Release 148667, Genian NAC 5.0.85 Release Stable 148666, Genian NAC 5.0.86 Release 148665, Genian ZTNA 6.0.35 LTS Release 148672, Genian ZTNA 6.0.45 Release Stable 148671, Genian ZTNA 6.0.46 Release 148670
Ids: CVE-2026-76142

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions

## Steps
1. Search the repo, its CI and infra config for Genians Genian NAC 5.0.75 LTS Release. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from krcert, not the vendor: Genian NAC 5.0.75 LTS Release: 148667. Genian NAC 5.0.85 Release Stable: 148666. Genian NAC 5.0.86 Release: 148665. Genian ZTNA 6.0.35 LTS Release: 148672. Genian ZTNA 6.0.45 Release Stable: 148671. Genian ZTNA 6.0.46 Release: 148670. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Genian NAC 5.0.75 LTS Release | per the CVE record from krcert, not the vendor | 148667 | restrict network access to it |
| Genian NAC 5.0.85 Release Stable | per the CVE record from krcert, not the vendor | 148666 | restrict network access to it |
| Genian NAC 5.0.86 Release | per the CVE record from krcert, not the vendor | 148665 | restrict network access to it |
| Genian ZTNA 6.0.35 LTS Release | per the CVE record from krcert, not the vendor | 148672 | restrict network access to it |
| Genian ZTNA 6.0.45 Release Stable | per the CVE record from krcert, not the vendor | 148671 | restrict network access to it |
| Genian ZTNA 6.0.46 Release | per the CVE record from krcert, not the vendor | 148670 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-76142") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://docs.genians.com/release/ko/advisories/GN-SA-2026-002.html https://nvd.nist.gov/vuln/detail/CVE-2026-76142
https://pwned.coffee/i/insufficient-authentication-and-access-control-on-the-in-cve-2026-76142

Receipt

Exploitation: No known exploitation
By release line, per the CVE record from krcert, not the vendor: Product Affected Version named Source
Genian NAC 5.0.75 LTS Release before 148667 148667 CVE record (CNA) per the CVE record from krcert, not the vendor checked 5 Nov
Genian NAC 5.0.85 Release Stable before 148666 148666 CVE record (CNA) per the CVE record from krcert, not the vendor checked 5 Nov
Genian NAC 5.0.86 Release before 148665 148665 CVE record (CNA) per the CVE record from krcert, not the vendor checked 5 Nov
Genian ZTNA 6.0.35 LTS Release before 148672 148672 CVE record (CNA) per the CVE record from krcert, not the vendor checked 5 Nov
Genian ZTNA 6.0.45 Release Stable before 148671 148671 CVE record (CNA) per the CVE record from krcert, not the vendor checked 5 Nov
Genian ZTNA 6.0.46 Release before 148670 148670 CVE record (CNA) per the CVE record from krcert, not the vendor checked 5 Nov
Score: CVSS 9.3 (critical). CVSS 4.0 9.3 (CNA krcert) for CVE-2026-76142
Last checked: 5 Nov 2026, 23:17 UTC

Product	Affected	Version named	Source
Genian NAC 5.0.75 LTS Release	before 148667	148667	CVE record (CNA) per the CVE record from krcert, not the vendor checked 5 Nov
Genian NAC 5.0.85 Release Stable	before 148666	148666	CVE record (CNA) per the CVE record from krcert, not the vendor checked 5 Nov
Genian NAC 5.0.86 Release	before 148665	148665	CVE record (CNA) per the CVE record from krcert, not the vendor checked 5 Nov
Genian ZTNA 6.0.35 LTS Release	before 148672	148672	CVE record (CNA) per the CVE record from krcert, not the vendor checked 5 Nov
Genian ZTNA 6.0.45 Release Stable	before 148671	148671	CVE record (CNA) per the CVE record from krcert, not the vendor checked 5 Nov
Genian ZTNA 6.0.46 Release	before 148670	148670	CVE record (CNA) per the CVE record from krcert, not the vendor checked 5 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Follow on X

Totalone very hot coffee