CVE-2026-101956: Juniper Networks Junos OS

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.

Affected products

• Juniper Networks Junos OS: from 25.2, before 25.2R2-S2 (fixed in 25.2R2-S2); from 25.4, before 25.4R1-S3 (fixed in 25.4R1-S3); from 26.2, before 26.2R1-S2 (fixed in 26.2R1-S2)

Published 2026-10-14. Last modified 2026-10-15.