CVE-2026-5267Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS
- 7.5HighCVSS base score
- 0.36%Exploitation in 30 daysEPSS · top 70% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive information.
Timeline
ID reserved
By Ciena
- 6 months later
· 6 months later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Deferred | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.36% · top 70% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
- affected 7.2 and any older release
- affected 7.2-P01 through 7.2-P07
- affected 8.0
- affected 8.0-P01 through 8.0-P06A
- affected 8.1
- affected 8.1-P01 through 8.1-P06
- affected 8.2
- affected 8.2-P01 through 8.2-P06
- affected 9.0
- affected 9.0-P01 through 9.0-P05A
- affected 9.1
- affected 9.1-P01 through 9.1-P05
- affected 9.2
- affected 9.2-P01 through 9.2-P02
- affected 10.0
- affected 10.0-P01 through 10.0-P01B
What to do
Solution: Ciena recommends upgrading to the latest available remediated release. For additional details, refer to myciena.com for current software versions, fixes, and security advisories. Remediation and Fixes: Products Remediated Version Navigator NCS 8.0-P06B and later 8.1-P06A and later 8.2-P07 and later 9.0-P05B and later 9.1-P05A and later 9.2-P02A and later 10.0-P01C and later
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-87295 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-5267)Record last updated .