CVE-2026-5267CWE-306

CVE-2026-5267

High · published September 26, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
28.6
In the wild
Unconfirmed
What it is

Ciena Navigator Network

Control Suite (NCS) contains an information exposure vulnerability in an

event-streaming API that does not properly enforce authentication. An

unauthenticated attacker with network access to the affected service could

access the event stream and potentially obtain sensitive information.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00360 · 28.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-26T00:17Z
References (1)
https://www.ciena.com/product-security · 7bd90cf1-1651-495e-9ae8-9415fb3c9feb
EPSS history
Timeline
  • 27 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 25 SEP 19:10Z
    Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS
    cvelistv5