CVE-2026-76142 describes an improper access control vulnerability (CWE-284) combined with insufficient authentication (CWE-306) in the internal IPC SOAP endpoint of the Genian NAC/ZTNA policy server within Genian NAC 5.0.75 LTS Release. The flaw permits unauthenticated attackers to invoke internal functions, bypassing intended access restrictions. The vulnerability affects multiple version intervals explicitly identified by build numbers. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and the product is not a cloud service.

An unauthenticated attacker can exploit this vulnerability remotely to invoke internal functions on the Genian NAC/ZTNA policy server, potentially leading to unauthorized access, data compromise, or disruption of service. The critical CVSS score of 9.3 reflects the high severity and ease of exploitation without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected IPC SOAP endpoint to trusted internal networks only, if possible. Monitor for unusual activity targeting this endpoint. Do not assume the vulnerability is mitigated without vendor confirmation.