CVE-2026-21902

Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root

View on CVE.org
Published Feb 25, 2026 CVSS 4.0 · 9.3 Critical EPSS 18.5% KEV · Not listed
Description
An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root.

The On-Box Anomaly detection framework should only be reachable by other internal processes over the internal routing instance, but not over an externally exposed port. With the ability to access and manipulate the service to execute code as root a remote attacker can take complete control of the device.
Please note that this service is enabled by default as no specific configuration is required.

This issue affects Junos OS Evolved on PTX Series:



* 25.4 versions before 25.4R1-S1-EVO, 25.4R2-EVO.




This issue does not affect Junos OS Evolved versions before 25.4R1-EVO.

This issue does not affect Junos OS.

Analysis

AI-generated

Technical impact

An incorrect permission assignment (CWE-732) in the On‑Box Anomaly detection framework allows an unauthenticated, network‑based attacker to access a service that should be reachable only by internal processes. Because the service is enabled by default, an attacker can manipulate it to execute arbitrary code with root privileges, effectively taking full control of the device.

Affected Systems

The vulnerability affects Juniper Networks Junos OS Evolved on PTX Series devices, specifically the PTX models listed in the CPE data (PTX10001-36mr, PTX10002-36qdd, PTX10003, PTX10004, PTX10008, PTX10016). Versions 25.4 earlier than 25.4R1‑S1‑EVO and 25.4R2‑EVO are impacted; later releases and versions before 25.4R1‑EVO are not.

Risk and Exploitability

The CVSS score is 9.3, indicating critical severity. The EPSS score is 18%, indicating a moderate probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Given the network‑based attack vector and the fact that the service is widely exposed by default, the risk of exploitation remains high until a patch is applied.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: 25.4R1-S1-EVO, 25.4R2-EVO*, 26.2R1-EVO*, and all subsequent releases. * Future Release

Vendor Workaround

To reduce the risk of exploitation of this issue, use access lists or firewall filters to limit access to only trusted networks and hosts. Please ensure such filters only permit explicitly required connections and block all others. Also this service can be disabled by 'request pfe anomalies disable'.

OpenCVE Recommended Actions

  • Apply the latest Junos OS release (25.4R1‑S1‑EVO, 25.4R2‑EVO, 26.2R1‑EVO, or later) to resolve the issue.
  • Configure access lists or firewall filters to limit external access to the anomaly detection service, allowing only trusted networks and hosts.
  • Disable the service with the command ‘request pfe anomalies disable’ until a patch can be applied.

Generated by OpenCVE AI on June 18, 2026 at 04:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Juniper
Juniper junos Os Evolved
Juniper ptx10001-36mr
Juniper ptx10002-36qdd
Juniper ptx10003
Juniper ptx10004
Juniper ptx10008
Juniper ptx10016
CPEs cpe:2.3:h:juniper:ptx10001-36mr:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:ptx10002-36qdd:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:ptx10003:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:ptx10004:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:ptx10008:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:ptx10016:-:*:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.4:r1:*:*:*:*:*:*
Vendors & Products Juniper
Juniper junos Os Evolved
Juniper ptx10001-36mr
Juniper ptx10002-36qdd
Juniper ptx10003
Juniper ptx10004
Juniper ptx10008
Juniper ptx10016
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os Evolved
Vendors & Products Juniper Networks
Juniper Networks junos Os Evolved
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root. The On-Box Anomaly detection framework should only be reachable by other internal processes over the internal routing instance, but not over an externally exposed port. With the ability to access and manipulate the service to execute code as root a remote attacker can take complete control of the device. Please note that this service is enabled by default as no specific configuration is required. This issue affects Junos OS Evolved on PTX Series: * 25.4 versions before 25.4R1-S1-EVO, 25.4R2-EVO. This issue does not affect Junos OS Evolved versions before 25.4R1-EVO. This issue does not affect Junos OS.
Title Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root
Weaknesses CWE-732
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:M/U:Red'}
Weaknesses
  • CWE-732

    Incorrect Permission Assignment for Critical Resource

Sources

Status
PUBLISHED
Assigner
juniper
Published
Updated
Mar 4, 2026, 4:55 AM
Reserved
Jan 5, 2026, 5:32 PM

View source JSON

Updated
Feb 25, 2026, 7:14 PM

JSON

Status
Analyzed
Published
Feb 25, 2026, 6:23 PM
Modified
Jun 17, 2026, 10:19 AM

View source JSON

No data.

Updated
Jun 18, 2026, 4:45 AM

JSON