Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-101956

Junos OS: Unauthorized root command execution when J-Web is enabled

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
juniper

Description

An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Juniper Networks Junos OS

Default version status: unaffected

  • 25.2 to < 25.2R2-S2affected
  • 25.4 to < 25.4R1-S3affected
  • 26.2 to < 26.2R1-S2affected

References