Patchfirst
Patchfirst
CVE-2026-101954 Critical · 9.8 EPSS 0.5%

An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper…

Juniper Networks · Junos OS

Summary

The Junos OS and Junos OS Evolved products from Juniper Networks contain an improper authentication flaw in the J-Web management interface and its NETCONF session handling. An unauthenticated network attacker who can reach the J-Web HTTP or HTTPS service, which is only exposed when web management is enabled, can obtain root-level device configuration access and take over the device, with no authentication or user interaction required.

Official description · NVD

An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.

Breakdown
17.3 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 14 Oct 2026. No public exploit code or confirmed exploitation is recorded.

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Not named in any threat report yet

Also mentioned in 8 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

1 link, grouped by NVD tag

Other 1

supportportal.juniper.net/JSA112187
↑ ↓ chooseEnter openEsc close