Is CVE-2026-36180 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-36180 being exploited in the wild.

How severe is CVE-2026-36180?

Informational severity, published 4 June 2026.

Is there a fix for CVE-2026-36180?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-36180 attacked?

It is attacked with physical access, in a network appliance.

Am I affected by CVE-2026-36180?

Check whether you run GNCC GP5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-36180: GNCC GP5 file system integrity bypass via bind-mount attack

CVE-2026-36180 · Severity: info · Published 2026-06-04

The GNCC GP5, an IoT device, contains a security flaw that allows an individual with physical access to the hardware to bypass built-in file protections. By manipulating how the system mounts its storage, an attacker can modify critical system files and software that are normally protected as read-only. This could allow an attacker to alter the device's behavior or compromise its security for the duration of the current power cycle.

Technologies: GNCC GP5. Vendors: GNCC.

Quick answers

Is CVE-2026-36180 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-36180 being exploited in the wild.
How severe is CVE-2026-36180?: Informational severity, published 4 June 2026.
Which products and versions are affected?: GNCC GP5 7.1.76.
Is there a fix for CVE-2026-36180?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-36180 attacked?: It is attacked with physical access, in a network appliance.
Am I affected by CVE-2026-36180?: Check whether you run GNCC GP5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The GNCC GP5 (v7.1.76) lacks sufficient runtime integrity checks, making it susceptible to a bind-mount attack. An attacker with physical access to the device can leverage this weakness to bypass read-only file system protections. By performing a bind-mount, the attacker can overlay writable directories over protected system paths, allowing for the modification of system binaries and configuration files. These modifications persist for the duration of the boot session, potentially allowing for arbitrary code execution or unauthorized configuration changes.

Affected products

GNCC GP5 7.1.76

Timeline

2026-06-04: disclosed
2026-06-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.