CIENA vulnerabilities
We track 5 vulnerabilities in CIENA products across 8 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 25, 2026.
Latest CIENA vulnerabilities
- 7.5 High severity
Navigator NCS: Missing Authentication for Critical Functionality
Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event s
- 9.8 Critical severity
Navigator NCS: Improper Authentication
An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an u
- 9.8 Critical severity
Navigator NCS: Use of Default Password
In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limite
- 9.1 Critical severity
6500 S-Series: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remote, unauthenticated attacker to bypass security controls and gain unauthorized access to the underlyin
- 8.0 High severity
Inventory (BPI): Improper Privilege Management
In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected. Blue Planet® has released software updates that address this vulnerability for the affe