CVE-2026-101954

CriticalCVSS 9.8/10Last modified Oct 16, 2026

Description

An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Juniper NetworksJunos OS>= 25.2, < 25.2R2-S2; >= 25.4, < 25.4R1-S3; >= 26.2, < 26.2R1-S2
Juniper NetworksJunos OS Evolved>= 25.2, < 25.2R2-S2-EVO; >= 25.4, < 25.4R1-S3-EVO; >= 26.2, < 26.2R1-S2-EVO; 23.4X100; >= 25.2X100, < 25.2X100-D35-EVO; >= 25.4X300, < 25.4X300-D40-EVO

References

Timeline

Published
Oct 14, 2026
Last modified
Oct 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1019558.1A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated reCVE-2026-1019569.8An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remoteCVE-2026-1019577.5An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remCVE-2026-1019596.5A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks JunoCVE-2026-101969.8The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object InjectioCVE-2026-1019606.5An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX52CVE-2026-1019617.5A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allowsCVE-2026-1019627.5An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and JCVE-2026-1019637.5An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP ECVE-2026-1019646.5A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacenCVE-2026-1019658.8An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated CVE-2026-1019668.2A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated
CVE-2026-101954: Critical severity, CVSS 9.8 | Vulnix