CVE-2026-5270: Authentication Bypass in Navigator and Blue Planet Products
An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.04.4 MR3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.04.800 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.04.P02-1-R - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.08.5 MR5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0-P04 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.2-P07 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1-P01 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1-P02 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.08 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.04.100 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.12.500 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.08.400 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.04.2-3-R - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.12.2.1-R - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.08.2.-1-R - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.04.3 MR3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.12.4 MR4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.04.MR2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.12.MR4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5270?
CVE-2026-5270 has a risk score of 77, indicating a high severity vulnerability.
How do I fix CVE-2026-5270?
To fix CVE-2026-5270, users should apply the latest patches and updates provided for Ciena Navigator Network Control Suite, Manage Control Plan, and Blue Planet products.
What products are affected by CVE-2026-5270?
CVE-2026-5270 affects Ciena Navigator Network Control Suite, Ciena Manage Control Plan, and Ciena Blue Planet.
What is the nature of the vulnerability in CVE-2026-5270?
CVE-2026-5270 is an authentication bypass vulnerability that allows unauthenticated attackers to manipulate requests.
When was CVE-2026-5270 published?
CVE-2026-5270 was published on July 14, 2026.