CVE-2026-5270

Authentication Bypass in Navigator and Blue Planet Products

Published Jul 14, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.

Remediation

Vendor Solution

Ciena recommends upgrading to the latest available remediated release. For additional details, refer to myciena.com for current software versions, fixes, and security advisories.   Remediation and Fixes:  Products Remediated Version BP Inventory >=24.08, 24.04.100, 23.12.500, 23.08.400, 23.04.800 BP Orchestration >=24.08, 24.04.3 MR3, 23.12.4 MR4, 23.08.5 MR5, 23.04.4 MR3 BP Route Optimization & Analysis >=24.08, 24.04.2-3-R, 23.12.2.1-R, 23.08.2.-1-R, 23.04.P02-1-R BP Unified Assurance & Analytics >=24.08, 24.04.MR2, 23.12.MR4 Navigator NCS >= 8.2, 8.1-P02 MCP 8.0-P04, 7.2-P07 Planner Plus OnPrem >= 4.2, 4.1-P01

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References
History
Type Values Removed Values Added
First Time appeared Blue Planet
Blue Planet inventory
Blue Planet orchestration
Blue Planet route Optimization & Analysis
Blue Planet unified Assurance & Analytics
Ciena
Ciena mcp
Ciena navigator Ncs
Ciena planner Plus Onprem
Vendors & Products Blue Planet
Blue Planet inventory
Blue Planet orchestration
Blue Planet route Optimization & Analysis
Blue Planet unified Assurance & Analytics
Ciena
Ciena mcp
Ciena navigator Ncs
Ciena planner Plus Onprem
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.
Title Authentication Bypass in Navigator and Blue Planet Products
Weaknesses CWE-287
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Ciena
Published
Updated
Jul 15, 2026, 12:39 PM
Reserved
Mar 31, 2026, 7:44 PM
Status
Awaiting Analysis
Published
Jul 14, 2026, 11:17 PM
Modified
Jul 15, 2026, 8:08 PM