Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-101983: Junos OS J-Web virtual domain lets remote attacker run code
CVE-2026-101983 · published today
Summary
Juniper's Junos OS and Junos OS Evolved web management interface (J-Web) can be tricked into running malicious code when a virtual domain is set up. An outside attacker could take control of the device or cause it to stop working. Apply the latest software updates from Juniper and disable virtual domains in J-Web if they are not needed.
What to do
- Update juniper networks junos os to version 23.4R2-S8.13 or later.
- Update juniper networks junos os evolved to version 23.4R2-S8.11-EVO or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| juniper networks | junos os | < 23.4R2-S8.13 |
| juniper networks | junos os evolved | < 23.4R2-S8.11-EVO |
Original advisory text
Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured
A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.
References
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.3
Critical
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta