CVE-2026-5270 (GCVE-0-2026-5270)

Vulnerability from cvelistv5 – Published: 2026-07-14 22:24 – Updated: 2026-07-14 22:24
VLAI
Title
Authentication Bypass in Navigator and Blue Planet Products
Summary
An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.
Severity
No CVSS data available.
CWE
  • CWE-287 - Improper Authentication
Assigner
References
Impacted products
Vendor Product Version
CIENA Navigator NCS Affected: 8.1
Create a notification for this product.
CIENA MCP Affected: <= 8.0
Create a notification for this product.
CIENA Planner Plus OnPrem Affected: <= 4.1
Create a notification for this product.
Blue Planet Inventory Affected: <=24.04.001
Affected: <=23.12.401
Affected: <=23.08.302
Affected: <=23.04.701
Create a notification for this product.
Blue Planet Orchestration Affected: <=24.04.2
Affected: <=23.12.3
Affected: <=23.08.4
Affected: <=23.04.2
Create a notification for this product.
Blue Planet Route Optimization & Analysis Affected: <=24.04.1.2-R
Affected: <=23.12.1.6-R
Affected: <=23.08.1.6-R
Affected: <=23.04.P01-9-R
Create a notification for this product.
Blue Planet Unified Assurance & Analytics Affected: <=24.04 MR1
Affected: <=23.12 MR3
Affected: <=23.04. MR4
Create a notification for this product.
Credits
Special thanks to the team at TDC NET for their contribution.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Navigator NCS",
          "vendor": "CIENA",
          "versions": [
            {
              "status": "affected",
              "version": "8.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MCP",
          "vendor": "CIENA",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 8.0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Planner Plus OnPrem",
          "vendor": "CIENA",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 4.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Inventory",
          "vendor": "Blue Planet",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=24.04.001"
            },
            {
              "status": "affected",
              "version": "\u003c=23.12.401"
            },
            {
              "status": "affected",
              "version": "\u003c=23.08.302"
            },
            {
              "status": "affected",
              "version": "\u003c=23.04.701"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Orchestration",
          "vendor": "Blue Planet",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=24.04.2"
            },
            {
              "status": "affected",
              "version": "\u003c=23.12.3"
            },
            {
              "status": "affected",
              "version": "\u003c=23.08.4"
            },
            {
              "status": "affected",
              "version": "\u003c=23.04.2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Route Optimization \u0026 Analysis",
          "vendor": "Blue Planet",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=24.04.1.2-R"
            },
            {
              "status": "affected",
              "version": "\u003c=23.12.1.6-R"
            },
            {
              "status": "affected",
              "version": "\u003c=23.08.1.6-R"
            },
            {
              "status": "affected",
              "version": "\u003c=23.04.P01-9-R"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Unified Assurance \u0026 Analytics",
          "vendor": "Blue Planet",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=24.04 MR1"
            },
            {
              "status": "affected",
              "version": "\u003c=23.12 MR3"
            },
            {
              "status": "affected",
              "version": "\u003c=23.04. MR4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Special thanks to the team at TDC NET for their contribution."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet\u0026nbsp;products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls."
            }
          ],
          "value": "An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet\u00a0products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T22:24:34.750Z",
        "orgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
        "shortName": "Ciena"
      },
      "references": [
        {
          "url": "https://www.ciena.com/product-security"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCiena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.\u003c/p\u003e\n\n\u003cp\u003e\u0026nbsp;\u003c/p\u003e\n\n\u003cp\u003e\u003cb\u003eRemediation\nand Fixes: \u003c/b\u003e\u003c/p\u003e\n\n\u003ctable\u003e\n \u003ctbody\u003e\u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u003cb\u003e\u0026nbsp;Products \u003c/b\u003e\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u003cb\u003eRemediated Version\u003c/b\u003e\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eBP Inventory\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;=24.08, 24.04.100, 23.12.500, 23.08.400,\n  23.04.800\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eBP Orchestration \u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;=24.08, 24.04.3 MR3, 23.12.4 MR4,\n  23.08.5 MR5, \u003cbr\u003e\n  23.04.4 MR3\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eBP Route Optimization \u0026amp; Analysis\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;=24.08, 24.04.2-3-R, 23.12.2.1-R, 23.08.2.-1-R, \u003cbr\u003e\n  23.04.P02-1-R\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eBP Unified Assurance \u0026amp; Analytics \u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;=24.08, 24.04.MR2, 23.12.MR4\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eNavigator NCS\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;= 8.2, 8.1-P02\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eMCP\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e8.0-P04, 7.2-P07\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003ePlanner Plus OnPrem\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;= 4.2, 4.1-P01\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "Ciena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.\n\n\n\n\n\n\u00a0\n\n\n\n\n\nRemediation\nand Fixes: \n\n\n\n\n \n  \n  \n\n\u00a0Products \n\n\n  \n  \n  \n\nRemediated Version\n\n\n  \n \n \n  \n  \n\nBP Inventory\n\n\n  \n  \n  \n\n\u003e=24.08, 24.04.100, 23.12.500, 23.08.400,\n  23.04.800\n\n\n  \n \n \n  \n  \n\nBP Orchestration \n\n\n  \n  \n  \n\n\u003e=24.08, 24.04.3 MR3, 23.12.4 MR4,\n  23.08.5 MR5, \n\n  23.04.4 MR3\n\n\n  \n \n \n  \n  \n\nBP Route Optimization \u0026 Analysis\n\n\n  \n  \n  \n\n\u003e=24.08, 24.04.2-3-R, 23.12.2.1-R, 23.08.2.-1-R, \n\n  23.04.P02-1-R\n\n\n  \n \n \n  \n  \n\nBP Unified Assurance \u0026 Analytics \n\n\n  \n  \n  \n\n\u003e=24.08, 24.04.MR2, 23.12.MR4\n\n\n  \n \n \n  \n  \n\nNavigator NCS\n\n\n  \n  \n  \n\n\u003e= 8.2, 8.1-P02\n\n\n  \n \n \n  \n  \n\nMCP\n\n\n  \n  \n  \n\n8.0-P04, 7.2-P07\n\n\n  \n \n \n  \n  \n\nPlanner Plus OnPrem\n\n\n  \n  \n  \n\n\u003e= 4.2, 4.1-P01"
        }
      ],
      "title": "Authentication Bypass in Navigator and Blue Planet Products",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
    "assignerShortName": "Ciena",
    "cveId": "CVE-2026-5270",
    "datePublished": "2026-07-14T22:24:34.750Z",
    "dateReserved": "2026-03-31T19:44:41.118Z",
    "dateUpdated": "2026-07-14T22:24:34.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-5270\",\"sourceIdentifier\":\"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\",\"published\":\"2026-07-14T23:17:34.570\",\"lastModified\":\"2026-07-14T23:17:34.570\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet\u00a0products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.\"}],\"affected\":[{\"source\":\"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\",\"affectedData\":[{\"vendor\":\"CIENA\",\"product\":\"Navigator NCS\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"8.1\",\"status\":\"affected\"}]},{\"vendor\":\"CIENA\",\"product\":\"MCP\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"\u003c= 8.0\",\"status\":\"affected\"}]},{\"vendor\":\"CIENA\",\"product\":\"Planner Plus OnPrem\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"\u003c= 4.1\",\"status\":\"affected\"}]},{\"vendor\":\"Blue Planet\",\"product\":\"Inventory\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"\u003c=24.04.001\",\"status\":\"affected\"},{\"version\":\"\u003c=23.12.401\",\"status\":\"affected\"},{\"version\":\"\u003c=23.08.302\",\"status\":\"affected\"},{\"version\":\"\u003c=23.04.701\",\"status\":\"affected\"}]},{\"vendor\":\"Blue Planet\",\"product\":\"Orchestration\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"\u003c=24.04.2\",\"status\":\"affected\"},{\"version\":\"\u003c=23.12.3\",\"status\":\"affected\"},{\"version\":\"\u003c=23.08.4\",\"status\":\"affected\"},{\"version\":\"\u003c=23.04.2\",\"status\":\"affected\"}]},{\"vendor\":\"Blue Planet\",\"product\":\"Route Optimization \u0026 Analysis\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"\u003c=24.04.1.2-R\",\"status\":\"affected\"},{\"version\":\"\u003c=23.12.1.6-R\",\"status\":\"affected\"},{\"version\":\"\u003c=23.08.1.6-R\",\"status\":\"affected\"},{\"version\":\"\u003c=23.04.P01-9-R\",\"status\":\"affected\"}]},{\"vendor\":\"Blue Planet\",\"product\":\"Unified Assurance \u0026 Analytics\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"\u003c=24.04 MR1\",\"status\":\"affected\"},{\"version\":\"\u003c=23.12 MR3\",\"status\":\"affected\"},{\"version\":\"\u003c=23.04. MR4\",\"status\":\"affected\"}]}]}],\"metrics\":{},\"weaknesses\":[{\"source\":\"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"references\":[{\"url\":\"https://www.ciena.com/product-security\",\"source\":\"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\"}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.