cve.nowby Sazabi
← All vulnerabilities
CVE-2026-101956

Junos OS: Unauthorized root command execution when J-Web is enabled

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 25.2R2-S2, 25.4R1-S3, 26.2R1-S2
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: yes
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.

Affected versions

  • Juniper Networks Junos OS

    From 25.2 · fixed in 25.2R2-S2; From 25.4 · fixed in 25.4R1-S3; From 26.2 · fixed in 26.2R1-S2

References 1

supportportal.juniper.net