Description
An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker executing specific, crafted CLI commands to inject arbitrary shell commands as root, leading to a complete compromise of the system.

Certain 'set system' commands, when executed with crafted arguments, are not properly sanitized, allowing for arbitrary shell injection. These shell commands are executed as root, potentially allowing for complete control of the vulnerable system.
This issue affects:

Junos OS: 



* all versions before 22.4R3-S8, 
* from 23.2 before 23.2R2-S5, 
* from 23.4 before 23.4R2-S7, 
* from 24.2 before 24.2R2-S2, 
* from 24.4 before 24.4R2, 
* from 25.2 before 25.2R2; 




Junos OS Evolved: 



* all versions before 22.4R3-S8-EVO, 
* from 23.2 before 23.2R2-S5-EVO, 
* from 23.4 before 23.4R2-S7-EVO, 
* from 24.2 before 24.2R2-S2-EVO, 
* from 24.4 before 24.4R2-EVO, 
* from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO.
Published: 2026-04-09
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary Shell Injection as Root
Action: Immediate Patch
AI Analysis

Impact

An OS command injection flaw in Juniper Networks Junos OS and Junos OS Evolved allows a local high‑privileged attacker to inject arbitrary shell commands by entering crafted 'set system' CLI commands. This vulnerability, classified as CWE‑78, grants root‑level execution and can lead to complete compromise of the device, impacting confidentiality, integrity, and availability.

Affected Systems

Affected products are Juniper Networks Junos OS and Junos OS Evolved. Vulnerable versions include all releases before 22.4R3‑S8, before 23.2R2‑S5, before 23.4R2‑S7, before 24.2R2‑S2, before 24.4R2, and before 25.2R2 for Junos OS, and the corresponding Evolved series before 22.4R3‑S8‑EVO, before 23.2R2‑S5‑EVO, before 23.4R2‑S7‑EVO, before 24.2R2‑S2‑EVO, before 24.4R2‑EVO, before 25.2R1‑S1‑EVO, and before 25.2R2‑EVO.

Risk and Exploitability

The CVSS score of 8.4 indicates a high severity vulnerability. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the risk remains significant because an attacker with local, high‑privileged access can exploit the flaw by entering crafted CLI commands. Successful exploitation grants unrestricted root command execution, enabling a full system takeover.

Generated by OpenCVE AI on April 9, 2026 at 23:23 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS 22.4R3-S8, 23.2R2-S5, 23.4R2-S7, 24.2R2-S2, 24.4R2, 25.2R2, 25.4R1, and all subsequent releases. Junos OS Evolved 22.4R3-S8-EVO, 23.2R2-S5-EVO, 23.4R2-S7-EVO, 24.2R2-S2-EVO, 24.4R2-EVO, 25.2R1-S1-EVO, 25.2R2-EVO, 25.4R1-EVO, and all subsequent releases.

Vendor Workaround

One of the following mitigations will reduce the risk of malicious exploitation: * Use access lists or firewall filters to limit access to the CLI only from trusted hosts and administrators. * Avoid configuring access to any part of the 'set system'​ stanza for non-privileged users.

OpenCVE Recommended Actions

  • Apply the latest Junos OS or Junos OS Evolved releases (22.4R3‑S8, 23.2R2‑S5, 23.4R2‑S7, 24.2R2‑S2, 24.4R2, 25.2R2, and all subsequent versions).
  • If patching is delayed, limit CLI access to trusted hosts and administrators using access lists or firewall filters to reduce exposure.
  • Restrict non‑privileged users from accessing any part of the 'set system' configuration stanza to prevent potential exploitation.

Generated by OpenCVE AI on April 9, 2026 at 23:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://kb.juniper.net/JSA107875 cve-icon cve-icon
History

Fri, 10 Apr 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved
Vendors & Products Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved

Thu, 09 Apr 2026 22:00:00 +0000

Type Values Removed Values Added
Description An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker executing specific, crafted CLI commands to inject arbitrary shell commands as root, leading to a complete compromise of the system. Certain 'set system' commands, when executed with crafted arguments, are not properly sanitized, allowing for arbitrary shell injection. These shell commands are executed as root, potentially allowing for complete control of the vulnerable system. This issue affects: Junos OS:  * all versions before 22.4R3-S8,  * from 23.2 before 23.2R2-S5,  * from 23.4 before 23.4R2-S7,  * from 24.2 before 24.2R2-S2,  * from 24.4 before 24.4R2,  * from 25.2 before 25.2R2;  Junos OS Evolved:  * all versions before 22.4R3-S8-EVO,  * from 23.2 before 23.2R2-S5-EVO,  * from 23.4 before 23.4R2-S7-EVO,  * from 24.2 before 24.2R2-S2-EVO,  * from 24.4 before 24.4R2-EVO,  * from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO.
Title Junos OS and Junos OS Evolved: Execution of crafted CLI commands allows for arbitrary shell injection as root
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M/U:Amber'}

Subscriptions

Juniper Networks Junos Os Junos Os Evolved
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-04-09T21:38:52.747Z

Reserved: 2026-03-23T19:46:13.672Z

Link: CVE-2026-33791

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-09T22:16:29.047

Modified: 2026-04-09T22:16:29.047

Link: CVE-2026-33791

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-10T09:27:46Z

Weaknesses