Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-102031: Junos OS Evolved lets low-level user run admin commands
CVE-2026-102031 · published today
Summary
Junos OS Evolved can be tricked by a user with only basic TACACS+ rights to run commands as the system administrator when the periodic authorization‑refresh feature is turned on. This gives the attacker full control over the device, which could lead to unauthorized changes or data exposure. Apply the vendor’s update or turn off the authorization‑refresh setting until the patch is installed.
What to do
- Update juniper networks junos os evolved to version 23.2R2-S7.7-EVO or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| juniper networks | junos os evolved | < 23.2R2-S7.7-EVO |
Original advisory text
Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled
An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled.
References
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.3
Critical
Type
CWE-78OS Command Injection
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta