Ciena Navigator NCS CVE-2026-5267

Exploitation requires network access to the Navigator NCS event-streaming API service, which fails to enforce authentication (CWE-306); any attacker who can reach that service endpoint can subscribe to the stream with no credentials and no user interaction (PR:N/UI:N/AC:L). The primary limiting factor is network reachability: Navigator NCS is a carrier/operator network-control platform normally deployed within management networks, so exposure depends on whether the event-streaming service is accessible from the attacker's network position. Impact is confidentiality-only - read access to streamed events - with no integrity or availability effect, and realized sensitivity depends on what data the specific event stream carries.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated confidentiality-only flaw - a classic missing-authentication information exposure (CWE-306). All impact is on confidentiality; there is no integrity or availability effect, so the 7.5 is driven entirely by the C:H rating. No EPSS score, KEV listing, POC reference, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified from these feeds - the only corroborating source beyond the Ciena vendor advisory is a VulDB advisory entry (no exploit code referenced). This is a genuine priority for organizations running the affected NCS versions because it needs no credentials and no user interaction, but the real-world blast radius is bounded by network exposure: the risk is high only where the event-streaming API is reachable by an attacker (Navigator NCS is typically deployed inside carrier/operator management networks rather than on the public Internet). Note the C:H rating assumes the event stream carries genuinely sensitive network-control data; the description hedges with 'potentially obtain sensitive information,' so the concrete sensitivity of exposed data should be verified against Ciena's advisory. No signal in the data indicates active exploitation.

An attacker with network access to a Navigator NCS deployment connects directly to the event-streaming API endpoint, which does not enforce authentication, and subscribes to the event stream. Because no credentials or user interaction are required (PR:N/UI:N/AC:L), the attacker passively harvests streamed events that may reveal network topology, device state, or operational telemetry. No public exploit code is identified at time of analysis, but the low complexity makes ad-hoc exploitation with standard HTTP/streaming clients trivial for anyone who can reach the service.