Read the docs
TI-2026-04603 Aliases CVE-2026-5268GHSA-m6c7-7xhp-6vhc

SFTP Server Authentication Weakness

Priority MEDIUM 48CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-288.

Summary

An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remote, unauthenticated attacker to bypass security controls and gain unauthorized access to the underlying filesystem. Successful exploitation could allow an attacker to read or modify system files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00665 52nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CIENA6500 S-SeriesR16.96 and prior—No fix listedCNA
CIENA6500 T-SeriesR16.1 and prior—No fix listedCNA
CIENAPTSR16.1 and prior—No fix listedCNA
CIENACPLR12.63 and prior—No fix listedCNA
  • 6500 S-Series VendorCIENA Affected R16.96 and prior Fixed in — No fix listed CNA
  • 6500 T-Series VendorCIENA Affected R16.1 and prior Fixed in — No fix listed CNA
  • PTS VendorCIENA Affected R16.1 and prior Fixed in — No fix listed CNA
  • CPL VendorCIENA Affected R12.63 and prior Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5268
  2. 2026-10-03 Alias added: GHSA-m6c7-7xhp-6vhc
  3. 2026-10-04 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2026-04605 Authentication Bypass in Navigator and Blue Planet Products CVSS 3.1CRITICAL 9.8
  • TI-2026-04604 Navigator NCS and MCP System Accounts with Default Passwords CVSS 3.1CRITICAL 9.8
  • TI-2024-01865 SAML implementation allows privilege escalation CVSS 3.1CRITICAL 9.0
  • TI-2026-04602 Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences