CVE-2026-5267

Summary

Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive information.

Affected Software

VendorProductVersion RangeStatus
CienaNavigator NCS7.2 and any older releaseaffected
CienaNavigator NCS7.2-P01 through 7.2-P07affected
CienaNavigator NCS8.0affected
CienaNavigator NCS8.0-P01 through 8.0-P06Aaffected
CienaNavigator NCS8.1affected
CienaNavigator NCS8.1-P01 through 8.1-P06affected
CienaNavigator NCS8.2affected
CienaNavigator NCS8.2-P01 through 8.2-P06affected
CienaNavigator NCS9.0affected
CienaNavigator NCS9.0-P01 through 9.0-P05Aaffected
CienaNavigator NCS9.1affected
CienaNavigator NCS9.1-P01 through 9.1-P05affected
CienaNavigator NCS9.2affected
CienaNavigator NCS9.2-P01 through 9.2-P02affected
CienaNavigator NCS10.0affected
CienaNavigator NCS10.0-P01 through 10.0-P01Baffected

Weaknesses

  • CWE-306: CWE-306 Missing authentication for critical function

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References