CVE-2026-5270

CriticalCVSS 9.8/10Last modified Jul 15, 2026

Description

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jul 14, 2026
Last modified
Jul 15, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-527008.5Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.CVE-2026-527016.5Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.CVE-2026-527027.1Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.CVE-2026-527039.6Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.CVE-2026-5270410.0Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code InCVE-2026-527059.0Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions.CVE-2026-527069.8Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.CVE-2026-527078.1Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.CVE-2026-52717.8pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. CVE-2026-527117.5Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.CVE-2026-527127.6Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.CVE-2026-527145.9Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.
CVE-2026-5270: Critical severity, CVSS 9.8 | Vulnix