{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Navigator NCS",
          "vendor": "CIENA",
          "versions": [
            {
              "status": "affected",
              "version": "8.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MCP",
          "vendor": "CIENA",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 8.0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Planner Plus OnPrem",
          "vendor": "CIENA",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 4.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Special thanks to the team at TDC NET for their contribution."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Ciena\u0027s Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system.\u0026nbsp;"
            }
          ],
          "value": "In Ciena\u0027s Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1393",
              "description": "CWE-1393 Use of default password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T22:25:55.317Z",
        "orgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
        "shortName": "Ciena"
      },
      "references": [
        {
          "url": "https://www.ciena.com/product-security"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCiena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.\u003c/p\u003e\n\n\u003cp\u003e\u0026nbsp;\u003c/p\u003e\n\n\u003cp\u003e\u003cb\u003eRemediation\nand Fixes: \u003c/b\u003e\u003c/p\u003e\n\n\u003ctable\u003e\n \u003ctbody\u003e\u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u003cb\u003e\u0026nbsp;Products \u003c/b\u003e\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u003cb\u003eRemediated Version\u003c/b\u003e\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eNavigator NCS\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;= 8.2, 8.1-P02\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003eMCP\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e8.0-P04, 7.2-P07\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n  \u003ctd\u003e\n  \u003cp\u003ePlanner Plus OnPrem\u003c/p\u003e\n  \u003c/td\u003e\n  \u003ctd\u003e\n  \u003cp\u003e\u0026gt;= 4.2, 4.1-P01\u003c/p\u003e\n  \u003c/td\u003e\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "Ciena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.\n\n\n\n\n\n\u00a0\n\n\n\n\n\nRemediation\nand Fixes: \n\n\n\n\n \n  \n  \n\n\u00a0Products \n\n\n  \n  \n  \n\nRemediated Version\n\n\n  \n \n \n  \n  \n\nNavigator NCS\n\n\n  \n  \n  \n\n\u003e= 8.2, 8.1-P02\n\n\n  \n \n \n  \n  \n\nMCP\n\n\n  \n  \n  \n\n8.0-P04, 7.2-P07\n\n\n  \n \n \n  \n  \n\nPlanner Plus OnPrem\n\n\n  \n  \n  \n\n\u003e= 4.2, 4.1-P01"
        }
      ],
      "title": "Navigator NCS and MCP System Accounts with Default Passwords",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
    "assignerShortName": "Ciena",
    "cveId": "CVE-2026-5269",
    "datePublished": "2026-07-14T22:25:55.317Z",
    "dateReserved": "2026-03-31T19:44:35.713Z",
    "dateUpdated": "2026-07-14T22:25:55.317Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-5269",
      "date": "2026-07-15",
      "epss": "0.00145",
      "percentile": "0.0413"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-5269\",\"sourceIdentifier\":\"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\",\"published\":\"2026-07-14T23:17:34.453\",\"lastModified\":\"2026-07-14T23:17:34.453\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Ciena\u0027s Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system.\"}],\"affected\":[{\"source\":\"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\",\"affectedData\":[{\"vendor\":\"CIENA\",\"product\":\"Navigator NCS\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"8.1\",\"status\":\"affected\"}]},{\"vendor\":\"CIENA\",\"product\":\"MCP\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"\u003c= 8.0\",\"status\":\"affected\"}]},{\"vendor\":\"CIENA\",\"product\":\"Planner Plus OnPrem\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"\u003c= 4.1\",\"status\":\"affected\"}]}]}],\"metrics\":{},\"weaknesses\":[{\"source\":\"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1393\"}]}],\"references\":[{\"url\":\"https://www.ciena.com/product-security\",\"source\":\"7bd90cf1-1651-495e-9ae8-9415fb3c9feb\"}]}}"
  }
}