Junos OS CVE-2026-101954

Exploitation requires that J-Web web management be explicitly enabled and that the attacker can reach the device's J-Web HTTP or HTTPS service over the network; the flaw lies in J-Web's NETCONF session handling. No authentication, credentials, or user interaction are needed once J-Web is reachable (PR:N/UI:N). The primary limiting factor is deployment configuration: devices with J-Web disabled, or with HTTP/HTTPS management restricted to trusted/out-of-band management networks or filtered by firewall rules, are not exposed. Affected platforms are limited to Junos OS and Junos OS Evolved.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the impact metrics (VC:H/VI:H/VA:H) align with the description's claim of root-level configuration access and full device takeover - the signals are internally consistent. CWE-287 (Improper Authentication) matches the stated authentication-bypass behavior. The decisive limiting factor is that J-Web web management must be enabled and the HTTP/HTTPS service must be reachable by the attacker; on hardened deployments J-Web is disabled or restricted to management networks, which meaningfully narrows the exposed population. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization at this time - the risk ranking rests on severity and ease of exploitation, not on observed in-the-wild activity. The 9.3 score reflects the subsequent-system metrics being mostly N (SC:N/SI:N/SA:L); an analyst focused purely on the compromised device could reasonably rate it higher. Bottom line: treat as urgent for any Junos/Junos Evolved device exposing J-Web, but exposure is conditional rather than universal.

An attacker who can reach a Junos device's J-Web HTTP or HTTPS service sends crafted requests that abuse the flawed NETCONF session handling to bypass authentication entirely, obtaining root-level access to the device configuration without any credentials or user interaction. From there they alter routing, firewall rules, or credentials to fully take over the device. No public exploit code was identified at time of analysis, but the low attack complexity makes reliable exploitation feasible once details are understood.