Vulnerabilities

TI-2026-04602 CVE-2026-5267 · GHSA-6mqq-ppj3-rm94

Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS

LOW 39

Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0036 Published 2026-09-25 No fix listed CWE-306

TI-2026-04604 CVE-2026-5269 · GHSA-6jrj-gphg-p8mj

Navigator NCS and MCP System Accounts with Default Passwords

MEDIUM 49

In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00483 Published 2026-07-14 No fix listed CWE-1393

TI-2026-04605 CVE-2026-5270 · GHSA-rp4h-q5qj-wrcr

Authentication Bypass in Navigator and Blue Planet Products

MEDIUM 50

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00664 Published 2026-07-14 No fix listed CWE-287

TI-2026-04603 CVE-2026-5268 · GHSA-m6c7-7xhp-6vhc

SFTP Server Authentication Weakness

MEDIUM 48

An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00665 Published 2026-07-06 No fix listed CWE-288

TI-2024-01865 CVE-2024-2005 · GHSA-j7p2-m4ff-pw4r

SAML implementation allows privilege escalation

MEDIUM 41

In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00453 Published 2024-03-05 Fixed in 21.10 MR11, 22.02 MR5 +8 CWE-269