CVE-2026-5268: SFTP Server Authentication Weakness

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-06 · updated 2026-07-08
Weakness: CWE-288

Description

An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remote, unauthenticated attacker to bypass security controls and gain unauthorized access to the underlying filesystem. Successful exploitation could allow an attacker to read or modify system files.

Affected products

CIENA 6500 S-Series: through R16.96
CIENA 6500 T-Series: through R16.1
CIENA CPL: through R12.63
CIENA PTS: through R16.1

References

https://www.ciena.com/product-security

Get alerted when CVE-2026-5268 or the next vulnerability affects your stack