Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-101986: Juniper J-Web lets unauthenticated user run commands
CVE-2026-101986 · published today
Summary
The web management interface (J-Web) in Junos OS and Junos OS Evolved can be accessed without logging in, allowing an outsider to run scripts with high-level rights. This could let an attacker change settings or take control of the device. Apply the latest software updates from Juniper and limit access to the J-Web interface to trusted networks only.
What to do
- Update juniper networks junos os to version 23.2R2-S7.7 or later.
- Update juniper networks junos os evolved to version 23.2R2-S7.7-EVO or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| juniper networks | junos os | < 23.2R2-S7.7 |
| juniper networks | junos os evolved | < 23.2R2-S7.7-EVO |
Original advisory text
Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution
An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request.
References
- https://supportportal.juniper.net/JSA112187 vendor-advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.3
Critical
Type
CWE-287Improper Authentication
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta