CVE-2026-5270
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
An authentication bypass vulnerability in Ciena Navigator NCS, MCP, and Blue Planet products due to improper handling of HTTP request paths and headers. An unauthenticated attacker can manipulate requests to bypass authentication and audit logging.
Risk Assessment
The risk involves unauthorized access to network management systems, potentially leading to control over infrastructure and data integrity compromise.
Recommendation
Apply security updates provided by Ciena for affected product versions immediately and implement additional HTTP request monitoring mechanisms.
Other vulnerabilities in Ciena Navigator Network Control Suite
See all- CVE-2026-5269Critical
In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), hidden system accounts with default, predictable passwords were discovered. These accounts have very limited permissions but could be used by an attacker in combination with other weaknesses to escalate privileges on the system.
- CVE-2026-5267High
Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive information.
Original NVD description (English source)
An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS