Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Junos OS/Evolved J-Web enables unauthenticated device takeover

CVE-2026-101954 · published today
Summary

If a Junos OS or Junos OS Evolved device has the J-Web web management interface turned on, anyone on the same network can connect to it without a password and gain full administrative control. This means the attacker could change settings, view or steal data, and essentially run the device as they wish. To protect the device, turn off J-Web when it is not required, limit network access to trusted hosts, and apply the latest security updates from the vendor.

What to do
  • Update juniper networks junos os to version 25.2R2-S2 or later.
  • Update juniper networks junos os evolved to version 25.2R2-S2-EVO or later.
Affected software
VendorProductAffected versions
juniper networks junos os < 25.2R2-S2
juniper networks junos os evolved < 25.2R2-S2-EVO
Original advisory text
Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled
An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Type
CWE-287Improper Authentication
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-101954 · NVD
CVE-2026-101954 · MITRE
Track software like this
Free during beta