CVE-2026-5269 (GCVE-0-2026-5269)

Vulnerability from cvelistv5 – Published: 2026-07-14 22:25 – Updated: 2026-07-15 14:30
VLAI
Title
Navigator NCS and MCP System Accounts with Default Passwords
Summary
In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Credits
Special thanks to the team at TDC NET for their contribution.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-5269",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T14:30:47.245049Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T14:30:50.769Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Navigator NCS",
          "vendor": "CIENA",
          "versions": [
            {
              "status": "affected",
              "version": "8.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MCP",
          "vendor": "CIENA",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 8.0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Planner Plus OnPrem",
          "vendor": "CIENA",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 4.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Special thanks to the team at TDC NET for their contribution."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Ciena\u0027s Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system.\u0026nbsp;"
            }
          ],
          "value": "In Ciena\u0027s Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1393",
              "description": "CWE-1393 Use of default password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T22:25:55.317Z",
        "orgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
        "shortName": "Ciena"
      },
      "references": [
        {
          "url": "https://www.ciena.com/product-security"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCiena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.\u003c/p\u003e\n\n\u003cp\u003e\u0026nbsp;\u003c/p\u003e\n\n\u003cp\u003e\u003cb\u003eRemediation\nand Fixes: \u003c/b\u003e\u003c/p\u003e\n\n\u003ctable\u003e\n \u003ctbody\u003e\u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u003cb\u003e\u0026nbsp;Products \u003c/b\u003e\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u003cb\u003eRemediated Version\u003c/b\u003e\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eNavigator NCS\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;= 8.2, 8.1-P02\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eMCP\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e8.0-P04, 7.2-P07\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003ePlanner Plus OnPrem\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;= 4.2, 4.1-P01\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "Ciena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.\n\n\n\n\n\n\u00a0\n\n\n\n\n\nRemediation\nand Fixes: \n\n\n\n\n \n  \n  \n\n\u00a0Products \n\n\n  \n  \n  \n\nRemediated Version\n\n\n  \n \n \n  \n  \n\nNavigator NCS\n\n\n  \n  \n  \n\n\u003e= 8.2, 8.1-P02\n\n\n  \n \n \n  \n  \n\nMCP\n\n\n  \n  \n  \n\n8.0-P04, 7.2-P07\n\n\n  \n \n \n  \n  \n\nPlanner Plus OnPrem\n\n\n  \n  \n  \n\n\u003e= 4.2, 4.1-P01"
        }
      ],
      "title": "Navigator NCS and MCP System Accounts with Default Passwords",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
    "assignerShortName": "Ciena",
    "cveId": "CVE-2026-5269",
    "datePublished": "2026-07-14T22:25:55.317Z",
    "dateReserved": "2026-03-31T19:44:35.713Z",
    "dateUpdated": "2026-07-15T14:30:50.769Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-5269",
      "date": "2026-07-15",
      "epss": "0.00145",
      "percentile": "0.0413"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-5269\",\"sourceIdentifier\":\"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\",\"published\":\"2026-07-14T23:17:34.453\",\"lastModified\":\"2026-07-15T20:08:02.787\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Ciena\u0027s Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system.\"}],\"affected\":[{\"source\":\"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\",\"affectedData\":[{\"vendor\":\"CIENA\",\"product\":\"Navigator NCS\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"8.1\",\"status\":\"affected\"}]},{\"vendor\":\"CIENA\",\"product\":\"MCP\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"\u003c= 8.0\",\"status\":\"affected\"}]},{\"vendor\":\"CIENA\",\"product\":\"Planner Plus OnPrem\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"\u003c= 4.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-15T14:30:47.245049Z\",\"id\":\"CVE-2026-5269\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1393\"}]}],\"references\":[{\"url\":\"https://www.ciena.com/product-security\",\"source\":\"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\", \"shortName\": \"Ciena\", \"dateUpdated\": \"2026-07-14T22:25:55.317Z\"}, \"title\": \"Navigator NCS and MCP System Accounts with Default Passwords\", \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"cweId\": \"CWE-1393\", \"description\": \"CWE-1393 Use of default password\", \"type\": \"CWE\"}]}], \"affected\": [{\"vendor\": \"CIENA\", \"product\": \"Navigator NCS\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.1\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CIENA\", \"product\": \"MCP\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 8.0\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CIENA\", \"product\": \"Planner Plus OnPrem\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 4.1\"}], \"defaultStatus\": \"unaffected\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"In Ciena\u0027s Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"In Ciena\u0027s Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system.\u0026nbsp;\"}]}], \"references\": [{\"url\": \"https://www.ciena.com/product-security\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Ciena recommends upgrading to the latest\\navailable remediated release. For additional details, refer to myciena.com for\\ncurrent software versions, fixes, and security advisories.\\n\\n\\n\\n\\n\\n\\u00a0\\n\\n\\n\\n\\n\\nRemediation\\nand Fixes: \\n\\n\\n\\n\\n \\n  \\n  \\n\\n\\u00a0Products \\n\\n\\n  \\n  \\n  \\n\\nRemediated Version\\n\\n\\n  \\n \\n \\n  \\n  \\n\\nNavigator NCS\\n\\n\\n  \\n  \\n  \\n\\n\u003e= 8.2, 8.1-P02\\n\\n\\n  \\n \\n \\n  \\n  \\n\\nMCP\\n\\n\\n  \\n  \\n  \\n\\n8.0-P04, 7.2-P07\\n\\n\\n  \\n \\n \\n  \\n  \\n\\nPlanner Plus OnPrem\\n\\n\\n  \\n  \\n  \\n\\n\u003e= 4.2, 4.1-P01\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eCiena recommends upgrading to the latest\\navailable remediated release. For additional details, refer to myciena.com for\\ncurrent software versions, fixes, and security advisories.\u003c/p\u003e\\n\\n\u003cp\u003e\u0026nbsp;\u003c/p\u003e\\n\\n\u003cp\u003e\u003cb\u003eRemediation\\nand Fixes: \u003c/b\u003e\u003c/p\u003e\\n\\n\u003ctable\u003e\\n \u003ctbody\u003e\u003ctr\u003e\\n  \u003ctd\u003e\\n  \u003cp\u003e\u003cb\u003e\u0026nbsp;Products \u003c/b\u003e\u003c/p\u003e\\n  \u003c/td\u003e\\n  \u003ctd\u003e\\n  \u003cp\u003e\u003cb\u003eRemediated Version\u003c/b\u003e\u003c/p\u003e\\n  \u003c/td\u003e\\n \u003c/tr\u003e\\n \u003ctr\u003e\\n  \u003ctd\u003e\\n  \u003cp\u003eNavigator NCS\u003c/p\u003e\\n  \u003c/td\u003e\\n  \u003ctd\u003e\\n  \u003cp\u003e\u0026gt;= 8.2, 8.1-P02\u003c/p\u003e\\n  \u003c/td\u003e\\n \u003c/tr\u003e\\n \u003ctr\u003e\\n  \u003ctd\u003e\\n  \u003cp\u003eMCP\u003c/p\u003e\\n  \u003c/td\u003e\\n  \u003ctd\u003e\\n  \u003cp\u003e8.0-P04, 7.2-P07\u003c/p\u003e\\n  \u003c/td\u003e\\n \u003c/tr\u003e\\n \u003ctr\u003e\\n  \u003ctd\u003e\\n  \u003cp\u003ePlanner Plus OnPrem\u003c/p\u003e\\n  \u003c/td\u003e\\n  \u003ctd\u003e\\n  \u003cp\u003e\u0026gt;= 4.2, 4.1-P01\u003c/p\u003e\\n  \u003c/td\u003e\\n \u003c/tr\u003e\\n\u003c/tbody\u003e\u003c/table\u003e\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"Special thanks to the team at TDC NET for their contribution.\", \"type\": \"finder\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-5269\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-15T14:30:47.245049Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-15T14:30:41.570Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-5269\", \"assignerOrgId\": \"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Ciena\", \"dateReserved\": \"2026-03-31T19:44:35.713Z\", \"datePublished\": \"2026-07-14T22:25:55.317Z\", \"dateUpdated\": \"2026-07-15T14:30:50.769Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.