CVE-2026-1364: JNC IAQS & I6 Auth Bypass Vulnerability

CVE-2026-1364 Overview

CVE-2026-1364 is a critical Missing Authentication vulnerability affecting IAQS and I6 systems developed by JNC. This authentication bypass flaw allows unauthenticated remote attackers to directly access and operate system administrative functionalities without providing valid credentials. The vulnerability stems from missing authentication checks on critical administrative endpoints, enabling attackers to perform privileged operations from a network-accessible position.

Critical Impact

Unauthenticated remote attackers can directly operate system administrative functionalities, potentially leading to complete system compromise, data exfiltration, and unauthorized configuration changes.

Affected Products

• JNC IAQS
• JNC I6

Discovery Timeline

• 2026-01-23 - CVE-2026-1364 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-1364

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), which occurs when software does not perform authentication for functionalities that require a proven user identity or consume significant resources. In the case of IAQS and I6 systems, administrative functions are exposed without proper authentication verification, allowing any network-accessible attacker to invoke these critical operations.

The network-based attack vector with low complexity means that exploitation requires no special conditions or user interaction. An attacker simply needs network access to the vulnerable system to exploit this flaw. The impact encompasses complete compromise of confidentiality, integrity, and availability of the affected systems.

Root Cause

The root cause of CVE-2026-1364 is the absence of authentication mechanisms protecting critical administrative endpoints in the IAQS and I6 applications. The system fails to verify user identity before granting access to privileged operations, a fundamental security control omission that violates the principle of defense in depth.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication, no privileges, and no user interaction. An attacker with network connectivity to vulnerable IAQS or I6 installations can directly invoke administrative functions. This could include operations such as system configuration changes, user management, data manipulation, or service control—all without presenting valid credentials.

The exploitation is straightforward: attackers send requests to administrative endpoints that lack proper authentication guards. Since no authentication challenge is presented, the system processes these requests as if they originated from a legitimate administrator.

Detection Methods for CVE-2026-1364

Indicators of Compromise

• Unexpected administrative operations performed without corresponding authenticated user sessions
• Access logs showing administrative endpoint requests from unusual IP addresses or without session tokens
• Configuration changes or user account modifications with no audit trail of authenticated administrator activity
• Anomalous network traffic patterns targeting administrative interfaces

Detection Strategies

• Monitor network traffic for requests to administrative endpoints that lack authentication headers or session identifiers
• Implement application-level logging to capture all administrative function invocations and correlate with authenticated sessions
• Deploy network intrusion detection systems (IDS) with rules targeting unauthenticated access patterns to IAQS and I6 administrative interfaces
• Review web server and application logs for direct access to administrative URLs without prior authentication

Monitoring Recommendations

• Enable verbose logging on IAQS and I6 systems to capture all administrative operations with user context
• Set up real-time alerting for administrative function calls that are not preceded by successful authentication events
• Establish baseline network behavior and alert on deviations in traffic patterns to administrative interfaces
• Periodically audit system configurations and user accounts for unauthorized changes

How to Mitigate CVE-2026-1364

Immediate Actions Required

• Restrict network access to IAQS and I6 administrative interfaces using firewall rules or network segmentation
• Place vulnerable systems behind a VPN or zero-trust network access solution until patches are applied
• Implement a web application firewall (WAF) to block unauthorized requests to administrative endpoints
• Conduct an immediate audit of system configurations and user accounts for signs of compromise

Patch Information

Consult the vendor JNC and the TW-CERT Security Advisory for official patch availability and installation instructions. Organizations should prioritize applying vendor-provided security updates as soon as they become available.

Additional details can be found in the TW-CERT Incident Report.

Workarounds

• Implement network-level access controls to restrict administrative interface access to trusted IP ranges only
• Deploy a reverse proxy with authentication enforcement in front of the vulnerable systems
• Disable or remove unnecessary administrative functionality until patches are applied
• Consider taking affected systems offline if they are internet-facing and cannot be adequately protected