EUVD-2026-101309
GHSA-wg6r-2r3p-3vc7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach J-Web interface over network
-
DeliverySend crafted HTTP request to httpd
-
ExploitOverflow stack buffer in parser
-
ExecutionExecute arbitrary code / crash service
-
ImpactRCE or denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target Junos OS or Junos OS Evolved device has the J-Web web management interface enabled AND a J-Web virtual-domain configured - this is a non-default configuration dependency that significantly limits the exploitable population. Where that condition is met, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed; a network attacker who can reach the J-Web HTTP(S) listener can trigger the overflow. The primary limiting factors are reachability of the J-Web interface (often restricted to management networks) and the presence of the virtual-domain configuration; devices without J-Web or without a configured virtual-domain are not affected. |
| Impact | This is a genuine high-priority issue, not an inflated-CVSS artifact. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an unauthenticated, network-reachable, low-complexity attack with high confidentiality, integrity and availability impact on the vulnerable system (VC:H/VI:H/VA:H), consistent with the described stack-based buffer overflow (CWE-121) in the httpd process yielding remote code execution. The one meaningful caveat is that the PR:N/AC:L rating does not reflect the stated precondition that a J-Web virtual-domain must be configured - this is a deployment/configuration dependency, not authentication, so it narrows the exploitable population without changing the auth requirement. Signals are partially missing: no EPSS score and no SSVC decision data were provided, and the CVE is NOT on CISA KEV with no POC referenced, so there is no evidence of active exploitation or public exploit code. The combination of unauthenticated network RCE on an edge network device plus an available vendor patch means this should be prioritized for patching on any Junos/Junos OS Evolved device with J-Web virtual-domains enabled, while recognizing exploitation feasibility is currently theoretical rather than demonstrated. |
| Exploit ScenarioDerived | An attacker with network access to the J-Web management interface of a Junos OS or Junos OS Evolved device that has a virtual-domain configured sends a crafted HTTP request that overflows a stack buffer in the httpd process, achieving remote code execution or crashing the service. No authentication is required per the CVSS vector. No public proof-of-concept or exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based buffer overflow (CWE-121) in the httpd process that serves the J-Web management interface, reachable by an unauthenticated network attacker who can reach the J-Web HTTP(S) listener. The vendor-assigned CVSS 4.0 score is 9.3 (and our independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. 9.8), reflecting full confidentiality, integrity and availability impact with no authentication or user interaction required; attack complexity is low in the base vector, though the real-world exploitable population is constrained by two configuration prerequisites. Successful exploitation is contingent on J-Web being enabled and a J-Web virtual-domain being configured - a non-default state - so devices with J-Web disabled or no virtual-domain configured are not affected. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
RemediationAI
Vendor-released patches are available; Juniper documents the fixed releases in JSA112187 (https://supportportal.juniper.net/JSA112187). Upgrade Junos OS to 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, or 26.2R1-S2 (or later on those trains as applicable), and Junos OS Evolved to 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4X300-D40-EVO, or 26.2R1-S2-EVO; note that the Evolved 23.4X100 train is listed as affected without a corresponding fixed release in the available data, so environments on that train should confirm migration or fix status directly with Juniper. Where immediate upgrading is not possible, the most effective compensating control is to disable the J-Web management interface entirely (if CLI/NETCONF management is sufficient), which removes the vulnerable httpd attack surface at the cost of losing browser-based management; a less disruptive but weaker alternative is to restrict reachability of the J-Web HTTP(S) listener to a dedicated out-of-band management network or jump host via firewall filters on the device and upstream ACLs, which reduces but does not eliminate exposure for anyone who can reach that segment. Because exploitation requires a J-Web virtual-domain to be configured, inventorying and removing unnecessary virtual-domain configurations narrows the affected population, though it is not a substitute for patching. Juniper advisories of this class typically also carry an associated hotfix or workaround note, so validate against JSA112187 for any release-train-specific guidance before applying changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic stack-based buffer overflow (CWE-121) in the httpd process that underpins Juniper's J-Web web-based device management interface on both Junos OS and Junos OS Evolved. Because the vulnerable code path is only exercised when J-Web is enabled and a J-Web virtual-domain is configured, the bug sits in the virtual-domain request-handling logic of the HTTP daemon rather than in core routing or control-plane services. CPE data (cpe:2.3:a:juniper_networks:junos_os and cpe:2.3:a:juniper_networks:junos_os_evolved) confirms both the classic Junos OS and the Evolved platform branches are impacted across a broad range of release trains spanning 23.4 through 26.2. Stack overflows of this class allow an attacker to overwrite adjacent stack memory, including saved return addresses or function pointers, which is what makes both remote code execution and process crash (denial of service) plausible outcomes. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N indicates the vulnerable path is network-reachable, requires no attack prerequisites beyond that reachability, and needs neither credentials nor victim interaction; the scope values (SC:N/SI:N/SA:L) mean compromise is contained to the vulnerable httpd component rather than the whole security authority, with only a limited availability impact at the subsequent-system level. Our independent assessment retains the same preconditions and rates overall severity as a genuine high-priority issue rather than an inflated-CVSS artifact.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L
Unauthenticated network RCE via J-Web httpd (AV:N/PR:N/UI:N); AC:L since the overflow needs no attacker-side special conditions, with full C/I/A impact on the device.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.
Executive ViewAI
Juniper Networks Junos OS and Junos OS Evolved contain a critical remote code execution vulnerability in the J-Web management interface that could allow an unauthenticated network attacker to fully compromise affected devices. This poses a severe risk to organizations relying on these devices for network infrastructure, as exploitation could lead to unauthorized access, data theft, and disruption of critical services. Leadership should prioritize immediate patching and review of J-Web configurations to mitigate potential business continuity and security breaches.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Stack-based buffer overflow in Juniper Networks Junos OS and Junos OS Evolved BGP flowspec handling allows a configured
Exploit-DB