CVE-2026-5269: Navigator NCS and MCP System Accounts with Default Passwords

Published Jul 14, 2026

Updated

In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system.

Affected Software

2 affected components

Ciena Navigator Network Control Suite (NCS)

Ciena Manage Control Plan (MCP)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ciena Navigator Network Control Suite (NCS) and Manage Control Plan (MCP) / Planner Plus OnPrem to a version that resolves this vulnerability.
Fixed in 8.0-P04
Upgrade
Upgrade Ciena Navigator Network Control Suite (NCS) and Manage Control Plan (MCP) / Planner Plus OnPrem to a version that resolves this vulnerability.
Fixed in 7.2-P07
Upgrade
Upgrade Ciena Navigator Network Control Suite (NCS) and Manage Control Plan (MCP) / Planner Plus OnPrem to a version that resolves this vulnerability.
Fixed in 4.2
Upgrade
Upgrade Ciena Navigator Network Control Suite (NCS) and Manage Control Plan (MCP) / Planner Plus OnPrem to a version that resolves this vulnerability.
Patch 4.1-P01
Upgrade
Upgrade Ciena Navigator Network Control Suite (NCS) and Manage Control Plan (MCP) / Planner Plus OnPrem to a version that resolves this vulnerability.
Fixed in 8.2
Upgrade
Upgrade Ciena Navigator Network Control Suite (NCS) and Manage Control Plan (MCP) / Planner Plus OnPrem to a version that resolves this vulnerability.
Patch 8.1-P02

Event History

Jul 14, 2026

CVE Published

via MITRE·10:25 PM

Data Sourced

via MITRE·10:25 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-5269?

The severity of CVE-2026-5269 is rated at 47, indicating a significant risk due to the presence of default passwords in hidden system accounts.

How do I fix CVE-2026-5269?

To fix CVE-2026-5269, change the default passwords of the hidden system accounts within the Ciena Navigator NCS and MCP systems.

What are the affected products for CVE-2026-5269?

CVE-2026-5269 affects Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP).

Who is impacted by CVE-2026-5269?

Organizations using Ciena Navigator NCS and MCP with default passwords enabled on hidden system accounts are impacted by CVE-2026-5269.

What happens if CVE-2026-5269 is exploited?

If exploited, CVE-2026-5269 could allow an attacker to gain unauthorized access to internal operations, potentially compromising network security.