CVE-2026-101954

An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.

Score

CVSS 3.1 9.8 Critical

Status

Awaiting Analysis - sirt@juniper.net

Published

2026-10-14

Last modified

2026-10-16

Weaknesses

CWE-287

Affected products

• Junos Os (Juniper Networks)
• Junos Os Evolved (Juniper Networks)

References

• https://supportportal.juniper.net/JSA112187