by Kastro
Paper/Archive/CVE-2026-5270

CVE-2026-5270

CIENA Navigator NCS — Authentication Bypass in Navigator and Blue Planet Products

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.7.517 × 2010.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.

Affected

ProductAffectedFixed inSource
Navigator NCS8.1–CNA
MCP<= 8.0–CNA
Planner Plus OnPrem<= 4.1–CNA
Inventory<=24.04.001–CNA
Inventory<=23.12.401–CNA
Inventory<=23.08.302–CNA
Inventory<=23.04.701–CNA
Orchestration<=24.04.2–CNA
Orchestration<=23.12.3–CNA
Orchestration<=23.08.4–CNA
Orchestration<=23.04.2–CNA
Route Optimization & Analysis<=24.04.1.2-R–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refciena.com/product-security