Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Juniper Junos OS J-Web allows remote root command execution

CVE-2026-101956 · published today
Summary

If the J-Web management interface is turned on, an attacker on the network can access it without any login and run any Junos command with full administrator rights. This could let the attacker change settings, view sensitive data, or take control of the device. Apply the latest Junos OS update or disable the J-Web interface until the patch is installed.

What to do
  • Update juniper networks junos os to version 25.2R2-S2 or later.
Affected software
VendorProductAffected versions
juniper networks junos os < 25.2R2-S2
Original advisory text
Junos OS: Unauthorized root command execution when J-Web is enabled
An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Type
CWE-287Improper Authentication
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-101956 · NVD
CVE-2026-101956 · MITRE
Track software like this
Free during beta