CVE-2026-5270
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
An authentication bypass vulnerability in Ciena Navigator NCS, MCP, and Blue Planet products due to improper handling of HTTP request paths and headers. An unauthenticated attacker can manipulate requests to bypass authentication and audit logging.
Risk Assessment
The risk involves unauthorized access to network management systems, potentially leading to control over infrastructure and data integrity compromise.
Recommendation
Apply security updates provided by Ciena for affected product versions immediately and implement additional HTTP request monitoring mechanisms.
Original NVD description (English source)
An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.