Key points
- The vulnerability affects Junos OS and Junos OS Evolved versions prior to specific security updates.
- Attackers can exploit the flaw via HTTP or HTTPS services when web management is enabled.
- The National Vulnerability Database rates the issue as critical with CVSS scores of 9.3 and 9.8.
Security researchers have identified a severe authentication bypass vulnerability within the J-Web management interface of Juniper Networks devices. This flaw, tracked as CVE-2026-101954, allows unauthenticated network attackers to obtain root-level configuration access. The issue resides in how the interface handles NETCONF sessions. When web management is enabled on affected systems, remote adversaries can exploit this weakness to take complete control of the device.
By the numbers
- CVSS 9.8: The highest severity rating assigned to the vulnerability in one NVD record.
- CVSS 9.3: The severity rating listed in a second NVD record for the same CVE.
- CWE-287: The Common Weakness Enumeration identifier for the improper authentication flaw.
What the figures mean
The dual CVSS scores of 9.3 and 9.8 both classify the vulnerability as critical. These high scores reflect the ease of exploitation and the severe impact of gaining root access. The weakness is categorized under CWE-287, indicating a failure in authentication mechanisms. Attackers do not need valid credentials to exploit this flaw. They only need network access to the J-Web service. This makes the vulnerability particularly dangerous for devices exposed to untrusted networks.
What to watch
Juniper Networks has identified specific version thresholds for remediation. Affected Junos OS versions include those before 25.2R2-S2, 25.4R1-S3, and 26.2R1-S2. Junos OS Evolved is also impacted, with vulnerabilities present in versions before 25.2R2-S2-EVO, 25.4R1-S3-EVO, and 26.2R1-S2-EVO. Additionally, the 23.4X100 release train for Junos OS Evolved remains vulnerable. Organizations must verify their current software versions against these lists.
Infection and persistence in general
Teams usually monitor for unauthorized configuration changes following an initial breach. Analysts examine management interface logs for successful login attempts from unknown IP addresses. Persistence often involves creating new administrative accounts or modifying existing credentials. Attackers may also install backdoors or modify routing tables to maintain access. Security operations should check for unexpected NETCONF session initiations. Reviewing system integrity and comparing current configurations against known good baselines helps detect compromise. Regular audits of administrative access rights are essential for maintaining security posture.
What to do and how to stay safe: Juniper Networks
- Audit all Juniper devices to confirm whether web management is enabled on interfaces accessible from untrusted networks.
- Verify the current software version of Junos OS and Junos OS Evolved against the affected version lists provided by the vendor.
- Monitor network traffic for unusual connections to the J-Web HTTP or HTTPS ports, especially from external sources.
- Once the vendor provides an update, apply the relevant security patches to bring devices to the minimum secure versions.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this Juniper vulnerability?
The vulnerability is identified as CVE-2026-101954 in the National Vulnerability Database records.
Which Juniper products are affected by this authentication bypass?
The flaw affects Juniper Networks Junos OS and Junos OS Evolved in versions prior to the specified security updates.
Does exploiting this vulnerability require attacker credentials?
No, the vulnerability allows unauthenticated network attackers to gain root-level access without valid credentials.
