Skip to content
Threat Feed
Subscribe
critical threat

Genians Genian NAC/ZTNA authentication bypass (CVE-2026-76142)

A critical unauthenticated IPC routing flaw (CVE-2026-76142) in Genian NAC and ZTNA allows remote attackers to perform arbitrary actions, including service disruption and unauthorized email relaying.

CVE search metadata

CVE search record: CVE-2026-76142. EPSS: 0.33%. KEV: no. Product: Genian NAC (<= 5.0.75 LTS), Genian ZTNA (<= 5.0.75 LTS). Brief: Genians Genian NAC/ZTNA authentication bypass (CVE-2026-76142). Brief link: https://feed.craftedsignal.io/briefs/2026-11-genian-nac-auth-bypass/

Triage facts

Revision 1
Applicability
Genian NAC (<= 5.0.75 LTS), Genian ZTNA (<= 5.0.75 LTS)
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
3 public sources
Freshness
Revision 1Nov 6, 02:20 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Very likely

Genian NAC and ZTNA products contain a critical vulnerability where the internal gnrpcsvc SOAP handler, exposed via an Apache reverse proxy, lacks authentication. The service was designed for trusted internal IPC, and the misconfiguration allows unauthenticated external requests to trigger internal functions with elevated authority. The vulnerability was disclosed with a working Proof of Concept (PoC) on 2026-11-05.

Impact

Successful exploitation allows remote, unauthenticated attackers to perform several high-impact actions:

  • Unauthorized email relaying through organizational SMTP infrastructure (impersonation/phishing).
  • Service control, including stop/restart commands (denial of service/NAC bypass).
  • Disclosure of sensitive information regarding managed nodes.

Recommendation

  • Patch Genian NAC and ZTNA to versions greater than 5.0.75 LTS immediately per the vendor advisory (GHSA-qf3p-2jpg-3h95).
  • Review and tighten the Apache reverse proxy configuration to restrict access to the /gnrpcsvc URI path, ensuring it is not accessible from external network interfaces.
  • Implement internal caller validation within the centerd process and associated IPC handlers as a defense-in-depth measure.

Immediate actions

Patch Genian NAC/ZTNA to versions > 5.0.75 LTS

IT Operations 24h

Threat Hunt

Search web server logs for HTTP requests to /gnrpcsvc/ from non-authorized internal or external IP ranges.

T1190 high high confidence hunt now

Data: Apache access logs

Mitigations

Restrict access to the /gnrpcsvc URI via Apache reverse proxy rules

immediate IT Operations

CVE-2026-76142

Detection coverage 1

Detect CVE-2026-76142 exploitation - Unauthenticated access to gnrpcsvc

critical

Detects potential exploitation of CVE-2026-76142 by identifying requests to the vulnerable gnrpcsvc endpoint via the Apache web server proxy.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →