Description
An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled.
Published: 2026-10-14
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: Remote command execution with root privileges
Action: Immediate patch
AI Analysis

Impact

The vulnerability is an OS command injection in the TACACS+ component of Juniper Networks Junos OS Evolved. A user with only low‑privileged TACACS+ credentials can supply crafted input that is passed directly to the operating‑system shell during a periodic authorization‑refresh. This allows the attacker to execute arbitrary commands with root privileges, effectively gaining full process‑level control of the device.

Affected Systems

All Juniper Networks Junos OS Evolved devices are affected, including the releases listed in the advisory (23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases).

Risk and Exploitability

The CVSS score of 9.3 indicates a high‑severity flaw. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is a network‑based threat that requires a legitimate TACACS+ user account; the periodic authorization‑refresh automatically triggers the injection, so exploitation does not need additional conditions beyond valid authentication.

Generated by OpenCVE AI on October 14, 2026 at 22:42 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Apply a Junos OS Evolved release from the fixed versions list or a later release.
  • If the TACACS+ authorization‑refresh feature cannot be disabled, restrict it to privileged users only.
  • Implement monitoring of TACACS+ authentication activity and system command executions to detect anomalous behavior.

Generated by OpenCVE AI on October 14, 2026 at 22:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled.
Title Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-14T16:49:50.342Z

Reserved: 2026-09-28T17:33:49.411Z

Link: CVE-2026-102031

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T17:17:56.617

Modified: 2026-10-14T17:17:56.617

Link: CVE-2026-102031

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-14T22:45:07Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')