{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/genian-ztna--5.0.75-lts/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["MalHyuk"],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-76142"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Genian NAC (\u003c= 5.0.75 LTS)","Genian ZTNA (\u003c= 5.0.75 LTS)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Genians"],"content_html":"\u003cp\u003eGenian NAC and ZTNA products contain a critical vulnerability where the internal \u003ccode\u003egnrpcsvc\u003c/code\u003e SOAP handler, exposed via an Apache reverse proxy, lacks authentication. The service was designed for trusted internal IPC, and the misconfiguration allows unauthenticated external requests to trigger internal functions with elevated authority. The vulnerability was disclosed with a working Proof of Concept (PoC) on 2026-11-05.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote, unauthenticated attackers to perform several high-impact actions:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUnauthorized email relaying through organizational SMTP infrastructure (impersonation/phishing).\u003c/li\u003e\n\u003cli\u003eService control, including stop/restart commands (denial of service/NAC bypass).\u003c/li\u003e\n\u003cli\u003eDisclosure of sensitive information regarding managed nodes.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Genian NAC and ZTNA to versions greater than 5.0.75 LTS immediately per the vendor advisory (GHSA-qf3p-2jpg-3h95).\u003c/li\u003e\n\u003cli\u003eReview and tighten the Apache reverse proxy configuration to restrict access to the \u003ccode\u003e/gnrpcsvc\u003c/code\u003e URI path, ensuring it is not accessible from external network interfaces.\u003c/li\u003e\n\u003cli\u003eImplement internal caller validation within the \u003ccode\u003ecenterd\u003c/code\u003e process and associated IPC handlers as a defense-in-depth measure.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T02:20:48Z","date_published":"2026-11-06T02:20:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-genian-nac-auth-bypass/","summary":"A critical unauthenticated IPC routing flaw (CVE-2026-76142) in Genian NAC and ZTNA allows remote attackers to perform arbitrary actions, including service disruption and unauthorized email relaying.","title":"Genians Genian NAC/ZTNA authentication bypass (CVE-2026-76142)","url":"https://feed.craftedsignal.io/briefs/2026-11-genian-nac-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Genian ZTNA (\u003c= 5.0.75 LTS)","version":"https://jsonfeed.org/version/1.1"}