Description
An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.
Published: 2026-10-14
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Device takeover via J-Web interface
Action: Patch immediately
AI Analysis

Impact

An authentication bypass in Juniper’s J-Web management interface allows any network user to acquire root-level configuration privileges and fully control the device when web management is enabled. This vulnerability is categorized as CWE-287, Improper Authentication. The flaw arises from improper authentication handling in the NETCONF session management of Junos OS and Junos OS Evolved, which effectively grants an attacker total authority over the system without needing valid credentials.

Affected Systems

This issue affects Juniper Networks Junos OS and Junos OS Evolved. The affected releases include Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases; and Junos OS Evolved 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.3, indicating high severity, and the EPSS score is not available, so the exact exploitation likelihood is uncertain. It is not listed in the CISA KEV catalog. The likely attack vector is a remote network attacker with access to the reachable J-Web HTTP or HTTPS service. Because authentication is bypassed, an unauthenticated attacker can acquire root‑level configuration privileges and fully control the device without valid credentials.

Generated by OpenCVE AI on October 15, 2026 at 14:41 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Apply any Junos OS release listed above or later releases that contain the fix.
  • Restrict inbound traffic to the J-Web ports (80 and 443) with firewall or access control lists until the patch is applied.
  • Enable audit logging or monitoring to detect unauthorized access attempts to the J-Web interface.

Generated by OpenCVE AI on October 15, 2026 at 14:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved
Vendors & Products Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved

Fri, 16 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.
Title Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L'}

Subscriptions

Juniper Networks Junos Os Junos Os Evolved
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-16T14:18:50.214Z

Reserved: 2026-09-28T16:28:35.624Z

Link: CVE-2026-101954

cve-icon Vulnrichment

Updated: 2026-10-16T14:17:49.074Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T18:17:11.277

Modified: 2026-10-16T15:16:59.280

Link: CVE-2026-101954

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T22:45:14Z

Weaknesses