Juniper Junos OS CVE-2026-101986

Exploitation requires network reachability to the J-Web web management interface of a running Junos OS or Junos OS Evolved device; the attacker sends a single crafted HTTP request and needs no credentials or user interaction (PR:N/UI:N). The primary limiting factor is exposure of J-Web itself - devices where J-Web is disabled, or where access is restricted to a dedicated management network via firewall filters/lo0 ACLs per Juniper hardening guidance, are not reachable by an arbitrary network attacker. Risk is therefore concentrated on devices whose J-Web interface is internet-facing or reachable from untrusted/flat networks. Exact vulnerable release trains should be confirmed against Juniper advisory JSA112187.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk inflation. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) describes an unauthenticated, network-reachable, low-complexity authentication bypass with high confidentiality, integrity, and availability impact - the worst-case combination for a management interface. CWE-287 (Improper Authentication) is consistent with the description's 'bypass J-Web authentication and execute CGI content with elevated privileges.' The critical limiting factor is exposure: exploitation requires network reachability to the J-Web management interface, which Juniper hardening guidance strongly recommends restricting to trusted management networks, so real-world risk hinges on whether J-Web is internet- or broadly-exposed. Signals conflict in completeness rather than substance: there is no EPSS score, no CISA KEV listing, and no public exploit referenced, so there is no evidence of active exploitation or widespread weaponization yet. The low-complexity unauthenticated-RCE-equivalent profile of J-Web bugs has historically attracted rapid exploit development and prior entries have reached CISA KEV, so this should be patched urgently despite the current absence of exploitation telemetry.

An attacker with network access to a Juniper device's J-Web interface sends a crafted HTTP request that bypasses authentication and causes CGI content to execute with elevated privileges, giving control over the device without any credentials or user interaction. No public proof-of-concept is referenced at time of analysis, but the unauthenticated, low-complexity nature (AV:N/AC:L/PR:N/UI:N) makes exploitation straightforward once the request structure is known. Internet-exposed or flat-network-reachable J-Web interfaces are the realistic targets.