An Improper Authentication flaw in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed web interface. The vulnerability can be leveraged to gain full control of the device, compromise data, and disable network services.

The affected product is Juniper Networks Junos OS. Versions impacted include 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent releases unless patched separately.

The CVSS score of 9.3 classifies this flaw as critical, indicating a high likelihood of successful compromise and broad impact. EPSS score is less than 1%, indicating a low probability of exploitation, but the absence of authentication means an attacker can exploit the flaw without prior credentials. The vulnerability is not listed in the CISA KEV catalog, yet its severity and remote nature make it a high risk to any network that uses J-Web. Exploitation requires remote access to the J-Web interface over the network, which is typically enabled via HTTP or HTTPS. No workaround is available, so the only effective mitigation is to deploy the patched versions as listed in the vendor solution or to remove the vulnerable interface from deployment.