CVE-2026-5267
HighCVSS 7.5Summary
Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive information.
Risk Assessment
An attacker can access sensitive information, potentially leading to data breach and further attacks.
Recommendation
Update Ciena NCS to a patched version if available, or enforce proper authentication on the event-streaming API.
Other vulnerabilities in Ciena Navigator Network Control Suite
See all- CVE-2026-5270Critical
An authentication bypass vulnerability in Ciena Navigator NCS, MCP, and Blue Planet products due to improper handling of HTTP request paths and headers. An unauthenticated attacker can manipulate requests to bypass authentication and audit logging.
- CVE-2026-5269Critical
In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), hidden system accounts with default, predictable passwords were discovered. These accounts have very limited permissions but could be used by an attacker in combination with other weaknesses to escalate privileges on the system.
Original NVD description (English source)
Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS