{"api_version":"1","generated_at":"2026-07-16T03:05:32+00:00","cve":"CVE-2026-5270","urls":{"html":"https://cve.report/CVE-2026-5270","api":"https://cve.report/api/cve/CVE-2026-5270.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-5270","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-5270"},"summary":{"title":"Authentication Bypass in Navigator and Blue Planet Products","description":"An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.","state":"PUBLISHED","assigner":"Ciena","published_at":"2026-07-14 23:17:34","updated_at":"2026-07-15 20:08:02"},"problem_types":["CWE-287","CWE-287 CWE-287 Improper Authentication"],"metrics":[{"version":"3.1","source":"ADP","type":"DECLARED","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}],"references":[{"url":"https://www.ciena.com/product-security","name":"https://www.ciena.com/product-security","refsource":"7bd90cf1-1651-495e-9ae8-9415fb3c9feb","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5270","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5270","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"CIENA","product":"Navigator NCS","version":"affected 8.1","platforms":[]},{"source":"CNA","vendor":"CIENA","product":"MCP","version":"affected <= 8.0","platforms":[]},{"source":"CNA","vendor":"CIENA","product":"Planner Plus OnPrem","version":"affected <= 4.1","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Inventory","version":"affected <=24.04.001","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Inventory","version":"affected <=23.12.401","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Inventory","version":"affected <=23.08.302","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Inventory","version":"affected <=23.04.701","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Orchestration","version":"affected <=24.04.2","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Orchestration","version":"affected <=23.12.3","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Orchestration","version":"affected <=23.08.4","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Orchestration","version":"affected <=23.04.2","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Route Optimization & Analysis","version":"affected <=24.04.1.2-R","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Route Optimization & Analysis","version":"affected <=23.12.1.6-R","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Route Optimization & Analysis","version":"affected <=23.08.1.6-R","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Route Optimization & Analysis","version":"affected <=23.04.P01-9-R","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Unified Assurance & Analytics","version":"affected <=24.04 MR1","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Unified Assurance & Analytics","version":"affected <=23.12 MR3","platforms":[]},{"source":"CNA","vendor":"Blue Planet","product":"Unified Assurance & Analytics","version":"affected <=23.04. MR4","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Ciena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.\n\n\n\n\n\n \n\n\n\n\n\nRemediation\nand Fixes: \n\n\n\n\n \n \n \n\n Products \n\n\n \n \n \n\nRemediated Version\n\n\n \n \n \n \n \n\nBP Inventory\n\n\n \n \n \n\n>=24.08, 24.04.100, 23.12.500, 23.08.400,\n 23.04.800\n\n\n \n \n \n \n \n\nBP Orchestration \n\n\n \n \n \n\n>=24.08, 24.04.3 MR3, 23.12.4 MR4,\n 23.08.5 MR5, \n\n 23.04.4 MR3\n\n\n \n \n \n \n \n\nBP Route Optimization & Analysis\n\n\n \n \n \n\n>=24.08, 24.04.2-3-R, 23.12.2.1-R, 23.08.2.-1-R, \n\n 23.04.P02-1-R\n\n\n \n \n \n \n \n\nBP Unified Assurance & Analytics \n\n\n \n \n \n\n>=24.08, 24.04.MR2, 23.12.MR4\n\n\n \n \n \n \n \n\nNavigator NCS\n\n\n \n \n \n\n>= 8.2, 8.1-P02\n\n\n \n \n \n \n \n\nMCP\n\n\n \n \n \n\n8.0-P04, 7.2-P07\n\n\n \n \n \n \n \n\nPlanner Plus OnPrem\n\n\n \n \n \n\n>= 4.2, 4.1-P01","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Special thanks to the team at TDC NET for their contribution.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"5270","cve":"CVE-2026-5270","epss":"0.002170000","percentile":"0.120580000","score_date":"2026-07-15","updated_at":"2026-07-16 00:08:43"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-5270","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-07-15T12:39:26.968950Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-07-15T12:39:32.248Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Navigator NCS","vendor":"CIENA","versions":[{"status":"affected","version":"8.1"}]},{"defaultStatus":"unaffected","product":"MCP","vendor":"CIENA","versions":[{"status":"affected","version":"<= 8.0"}]},{"defaultStatus":"unaffected","product":"Planner Plus OnPrem","vendor":"CIENA","versions":[{"status":"affected","version":"<= 4.1"}]},{"defaultStatus":"unaffected","product":"Inventory","vendor":"Blue Planet","versions":[{"status":"affected","version":"<=24.04.001"},{"status":"affected","version":"<=23.12.401"},{"status":"affected","version":"<=23.08.302"},{"status":"affected","version":"<=23.04.701"}]},{"defaultStatus":"unaffected","product":"Orchestration","vendor":"Blue Planet","versions":[{"status":"affected","version":"<=24.04.2"},{"status":"affected","version":"<=23.12.3"},{"status":"affected","version":"<=23.08.4"},{"status":"affected","version":"<=23.04.2"}]},{"defaultStatus":"unaffected","product":"Route Optimization & Analysis","vendor":"Blue Planet","versions":[{"status":"affected","version":"<=24.04.1.2-R"},{"status":"affected","version":"<=23.12.1.6-R"},{"status":"affected","version":"<=23.08.1.6-R"},{"status":"affected","version":"<=23.04.P01-9-R"}]},{"defaultStatus":"unaffected","product":"Unified Assurance & Analytics","vendor":"Blue Planet","versions":[{"status":"affected","version":"<=24.04 MR1"},{"status":"affected","version":"<=23.12 MR3"},{"status":"affected","version":"<=23.04. MR4"}]}],"credits":[{"lang":"en","type":"finder","value":"Special thanks to the team at TDC NET for their contribution."}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls."}],"value":"An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","description":"CWE-287 Improper Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-14T22:24:34.750Z","orgId":"7bd90cf1-1651-495e-9ae8-9415fb3c9feb","shortName":"Ciena"},"references":[{"url":"https://www.ciena.com/product-security"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

Ciena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.

\n\n

 

\n\n

Remediation\nand Fixes:

\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

 Products

\n 		\n

Remediated Version

\n
\n

BP Inventory

\n 		\n

>=24.08, 24.04.100, 23.12.500, 23.08.400,\n 23.04.800

\n
\n

BP Orchestration

\n 		\n

>=24.08, 24.04.3 MR3, 23.12.4 MR4,\n 23.08.5 MR5,
\n 23.04.4 MR3

\n
\n

BP Route Optimization & Analysis

\n 		\n

>=24.08, 24.04.2-3-R, 23.12.2.1-R, 23.08.2.-1-R,
\n 23.04.P02-1-R

\n
\n

BP Unified Assurance & Analytics

\n 		\n

>=24.08, 24.04.MR2, 23.12.MR4

\n
\n

Navigator NCS

\n 		\n

>= 8.2, 8.1-P02

\n
\n

MCP

\n 		\n

8.0-P04, 7.2-P07

\n
\n

Planner Plus OnPrem

\n 		\n

>= 4.2, 4.1-P01

\n
"}],"value":"Ciena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.\n\n\n\n\n\n \n\n\n\n\n\nRemediation\nand Fixes: \n\n\n\n\n \n \n \n\n Products \n\n\n \n \n \n\nRemediated Version\n\n\n \n \n \n \n \n\nBP Inventory\n\n\n \n \n \n\n>=24.08, 24.04.100, 23.12.500, 23.08.400,\n 23.04.800\n\n\n \n \n \n \n \n\nBP Orchestration \n\n\n \n \n \n\n>=24.08, 24.04.3 MR3, 23.12.4 MR4,\n 23.08.5 MR5, \n\n 23.04.4 MR3\n\n\n \n \n \n \n \n\nBP Route Optimization & Analysis\n\n\n \n \n \n\n>=24.08, 24.04.2-3-R, 23.12.2.1-R, 23.08.2.-1-R, \n\n 23.04.P02-1-R\n\n\n \n \n \n \n \n\nBP Unified Assurance & Analytics \n\n\n \n \n \n\n>=24.08, 24.04.MR2, 23.12.MR4\n\n\n \n \n \n \n \n\nNavigator NCS\n\n\n \n \n \n\n>= 8.2, 8.1-P02\n\n\n \n \n \n \n \n\nMCP\n\n\n \n \n \n\n8.0-P04, 7.2-P07\n\n\n \n \n \n \n \n\nPlanner Plus OnPrem\n\n\n \n \n \n\n>= 4.2, 4.1-P01"}],"title":"Authentication Bypass in Navigator and Blue Planet Products","x_generator":{"engine":"Vulnogram 1.0.2"}}},"cveMetadata":{"assignerOrgId":"7bd90cf1-1651-495e-9ae8-9415fb3c9feb","assignerShortName":"Ciena","cveId":"CVE-2026-5270","datePublished":"2026-07-14T22:24:34.750Z","dateReserved":"2026-03-31T19:44:41.118Z","dateUpdated":"2026-07-15T12:39:32.248Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-14 23:17:34","lastModifiedDate":"2026-07-15 20:08:02","problem_types":["CWE-287","CWE-287 CWE-287 Improper Authentication"],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-15T12:39:26.968950Z","id":"CVE-2026-5270","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"5270","Ordinal":"1","Title":"Authentication Bypass in Navigator and Blue Planet Products","CVE":"CVE-2026-5270","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"5270","Ordinal":"1","NoteData":"An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.","Type":"Description","Title":"Authentication Bypass in Navigator and Blue Planet Products"}]}}}