Advisoriesby IbisCienaCVE-2026-5267
Ciena Navigator NCS: information disclosure
No fix yet
Ciena Navigator Network
Control Suite (NCS) contains an information exposure vulnerability in an
event-streaming API that does not properly enforce authentication. An
unauthenticated attacker with network access to the affected service could
access the event stream and potentially obtain sensitive information.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Navigator NCS Product | <= 7.2 and any older release | No fix yet |
| <= 7.2-P01 through 7.2-P07 | No fix yet | |
| <= 8.0 | No fix yet | |
| <= 8.0-P01 through 8.0-P06A | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- CISA (its enrichment of the CVE record)
- Weakness
- CWE-306