An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00217.

Exploitation none

Automatable yes

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
CIENA Navigator NCS unaffected
Version Status Constraints
8.1 affected —
CIENA MCP unaffected
Version Status Constraints
<= 8.0 affected —
CIENA Planner Plus OnPrem unaffected
Version Status Constraints
<= 4.1 affected —
Blue Planet Inventory unaffected
Version Status Constraints
<=24.04.001 affected —
<=23.12.401 affected —
<=23.08.302 affected —
<=23.04.701 affected —
Blue Planet Orchestration unaffected
Version Status Constraints
<=24.04.2 affected —
<=23.12.3 affected —
<=23.08.4 affected —
<=23.04.2 affected —
Blue Planet Route Optimization & Analysis unaffected
Version Status Constraints
<=24.04.1.2-R affected —
<=23.12.1.6-R affected —
<=23.08.1.6-R affected —
<=23.04.P01-9-R affected —
Blue Planet Unified Assurance & Analytics unaffected
Version Status Constraints
<=24.04 MR1 affected —
<=23.12 MR3 affected —
<=23.04. MR4 affected —

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

Ciena recommends upgrading to the latest available remediated release. For additional details, refer to myciena.com for current software versions, fixes, and security advisories.   Remediation and Fixes:  Products Remediated Version BP Inventory >=24.08, 24.04.100, 23.12.500, 23.08.400, 23.04.800 BP Orchestration >=24.08, 24.04.3 MR3, 23.12.4 MR4, 23.08.5 MR5, 23.04.4 MR3 BP Route Optimization & Analysis >=24.08, 24.04.2-3-R, 23.12.2.1-R, 23.08.2.-1-R, 23.04.P02-1-R BP Unified Assurance & Analytics >=24.08, 24.04.MR2, 23.12.MR4 Navigator NCS >= 8.2, 8.1-P02 MCP 8.0-P04, 7.2-P07 Planner Plus OnPrem >= 4.2, 4.1-P01

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.ciena.com/product-security cve-icon
History

Wed, 15 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Description An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.
Title Authentication Bypass in Navigator and Blue Planet Products
Weaknesses CWE-287
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Ciena

Published:

Updated: 2026-07-15T12:39:32.248Z

Reserved: 2026-03-31T19:44:41.118Z

Link: CVE-2026-5270

cve-icon Vulnrichment

Updated: 2026-07-15T12:39:11.872Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses