CVE-2026-5268CWE-288

SFTP Server Authentication Weakness

Critical · published July 6, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
51.2
In the wild
Unconfirmed
What it is

An authentication bypass vulnerability exists in

the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remote, unauthenticated attacker to bypass

security controls and gain unauthorized access to the underlying filesystem.

Successful exploitation could allow an attacker to read or modify system files.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00665 · 51.2th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-07-06T15:25Z
EPSS history
Timeline
  • 06 JUL 15:25Z
    SFTP Server Authentication Weakness
    cvelistv5