CVE-2026-5269 (GCVE-0-2026-5269)
Vulnerability from cvelistv5
Published
2026-07-14 22:25
Modified
2026-07-15 14:30
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-1393 - Use of default password
Summary
In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system.
References
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CIENA | Navigator NCS |
Version: 8.1 |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-5269",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T14:30:47.245049Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T14:30:50.769Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Navigator NCS",
"vendor": "CIENA",
"versions": [
{
"status": "affected",
"version": "8.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MCP",
"vendor": "CIENA",
"versions": [
{
"status": "affected",
"version": "\u003c= 8.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Planner Plus OnPrem",
"vendor": "CIENA",
"versions": [
{
"status": "affected",
"version": "\u003c= 4.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Special thanks to the team at TDC NET for their contribution."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Ciena\u0027s Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system.\u0026nbsp;"
}
],
"value": "In Ciena\u0027s Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1393",
"description": "CWE-1393 Use of default password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T22:25:55.317Z",
"orgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
"shortName": "Ciena"
},
"references": [
{
"url": "https://www.ciena.com/product-security"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCiena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.\u003c/p\u003e\n\n\u003cp\u003e\u0026nbsp;\u003c/p\u003e\n\n\u003cp\u003e\u003cb\u003eRemediation\nand Fixes: \u003c/b\u003e\u003c/p\u003e\n\n\u003ctable\u003e\n \u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cb\u003e\u0026nbsp;Products \u003c/b\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cb\u003eRemediated Version\u003c/b\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003eNavigator NCS\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u0026gt;= 8.2, 8.1-P02\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003eMCP\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e8.0-P04, 7.2-P07\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003ePlanner Plus OnPrem\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u0026gt;= 4.2, 4.1-P01\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "Ciena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.\n\n\n\n\n\n\u00a0\n\n\n\n\n\nRemediation\nand Fixes: \n\n\n\n\n \n \n \n\n\u00a0Products \n\n\n \n \n \n\nRemediated Version\n\n\n \n \n \n \n \n\nNavigator NCS\n\n\n \n \n \n\n\u003e= 8.2, 8.1-P02\n\n\n \n \n \n \n \n\nMCP\n\n\n \n \n \n\n8.0-P04, 7.2-P07\n\n\n \n \n \n \n \n\nPlanner Plus OnPrem\n\n\n \n \n \n\n\u003e= 4.2, 4.1-P01"
}
],
"title": "Navigator NCS and MCP System Accounts with Default Passwords",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
"assignerShortName": "Ciena",
"cveId": "CVE-2026-5269",
"datePublished": "2026-07-14T22:25:55.317Z",
"dateReserved": "2026-03-31T19:44:35.713Z",
"dateUpdated": "2026-07-15T14:30:50.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\", \"shortName\": \"Ciena\", \"dateUpdated\": \"2026-07-14T22:25:55.317Z\"}, \"title\": \"Navigator NCS and MCP System Accounts with Default Passwords\", \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"cweId\": \"CWE-1393\", \"description\": \"CWE-1393 Use of default password\", \"type\": \"CWE\"}]}], \"affected\": [{\"vendor\": \"CIENA\", \"product\": \"Navigator NCS\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.1\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CIENA\", \"product\": \"MCP\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 8.0\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CIENA\", \"product\": \"Planner Plus OnPrem\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 4.1\"}], \"defaultStatus\": \"unaffected\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"In Ciena\u0027s Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"In Ciena\u0027s Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system.\u0026nbsp;\"}]}], \"references\": [{\"url\": \"https://www.ciena.com/product-security\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Ciena recommends upgrading to the latest\\navailable remediated release. For additional details, refer to myciena.com for\\ncurrent software versions, fixes, and security advisories.\\n\\n\\n\\n\\n\\n\\u00a0\\n\\n\\n\\n\\n\\nRemediation\\nand Fixes: \\n\\n\\n\\n\\n \\n \\n \\n\\n\\u00a0Products \\n\\n\\n \\n \\n \\n\\nRemediated Version\\n\\n\\n \\n \\n \\n \\n \\n\\nNavigator NCS\\n\\n\\n \\n \\n \\n\\n\u003e= 8.2, 8.1-P02\\n\\n\\n \\n \\n \\n \\n \\n\\nMCP\\n\\n\\n \\n \\n \\n\\n8.0-P04, 7.2-P07\\n\\n\\n \\n \\n \\n \\n \\n\\nPlanner Plus OnPrem\\n\\n\\n \\n \\n \\n\\n\u003e= 4.2, 4.1-P01\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eCiena recommends upgrading to the latest\\navailable remediated release. For additional details, refer to myciena.com for\\ncurrent software versions, fixes, and security advisories.\u003c/p\u003e\\n\\n\u003cp\u003e\u0026nbsp;\u003c/p\u003e\\n\\n\u003cp\u003e\u003cb\u003eRemediation\\nand Fixes: \u003c/b\u003e\u003c/p\u003e\\n\\n\u003ctable\u003e\\n \u003ctbody\u003e\u003ctr\u003e\\n \u003ctd\u003e\\n \u003cp\u003e\u003cb\u003e\u0026nbsp;Products \u003c/b\u003e\u003c/p\u003e\\n \u003c/td\u003e\\n \u003ctd\u003e\\n \u003cp\u003e\u003cb\u003eRemediated Version\u003c/b\u003e\u003c/p\u003e\\n \u003c/td\u003e\\n \u003c/tr\u003e\\n \u003ctr\u003e\\n \u003ctd\u003e\\n \u003cp\u003eNavigator NCS\u003c/p\u003e\\n \u003c/td\u003e\\n \u003ctd\u003e\\n \u003cp\u003e\u0026gt;= 8.2, 8.1-P02\u003c/p\u003e\\n \u003c/td\u003e\\n \u003c/tr\u003e\\n \u003ctr\u003e\\n \u003ctd\u003e\\n \u003cp\u003eMCP\u003c/p\u003e\\n \u003c/td\u003e\\n \u003ctd\u003e\\n \u003cp\u003e8.0-P04, 7.2-P07\u003c/p\u003e\\n \u003c/td\u003e\\n \u003c/tr\u003e\\n \u003ctr\u003e\\n \u003ctd\u003e\\n \u003cp\u003ePlanner Plus OnPrem\u003c/p\u003e\\n \u003c/td\u003e\\n \u003ctd\u003e\\n \u003cp\u003e\u0026gt;= 4.2, 4.1-P01\u003c/p\u003e\\n \u003c/td\u003e\\n \u003c/tr\u003e\\n\u003c/tbody\u003e\u003c/table\u003e\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"Special thanks to the team at TDC NET for their contribution.\", \"type\": \"finder\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-5269\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-15T14:30:47.245049Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-15T14:30:41.570Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2026-5269\", \"assignerOrgId\": \"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Ciena\", \"dateReserved\": \"2026-03-31T19:44:35.713Z\", \"datePublished\": \"2026-07-14T22:25:55.317Z\", \"dateUpdated\": \"2026-07-15T14:30:50.769Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…