Is there a patch available for CVE-2026-21904?

Yes, a patch is available for CVE-2026-21904. Update the affected software to the latest version immediately.

Junos Space CVE-2026-21904

Q: What is the CVSS score of CVE-2026-21904?

CVE-2026-21904 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21077 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-09 juniper

GHSA-3cpj-89qh-f3x6

XSS Juniper Junos Space

5.1

CVSS 4.0 · Vendor: juniper

Severity by source

Vendor (juniper) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (juniper) · only source for this CVE.

CVSS VectorVendor: juniper

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

24.1R5

EUVD ID Assigned

Apr 09, 2026 - 21:45 euvd

EUVD-2026-21077

Analysis Generated

Apr 09, 2026 - 21:45 vuln.today

CVE Published

Apr 09, 2026 - 21:26 nvd

MEDIUM 5.1

DescriptionCVE.org

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the

list filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.

This issue affects all versions of Junos Space before 24.1R5 Patch V3.

AnalysisAI

Stored cross-site scripting (XSS) in Juniper Networks Junos Space allows unauthenticated remote attackers to inject malicious script tags into the list filter field, which execute with the permissions of any user who views the affected page, including administrators. All versions before 24.1R5 Patch V3 are vulnerable. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Junos Space is a network management platform developed by Juniper Networks. The vulnerability exists in improper input sanitization (CWE-79: Improper Neutralization of Input During Web Page Generation) affecting the list filter field, a web interface component. The vulnerability allows attackers to inject unescaped HTML script tags that persist in the application and execute in the context of subsequent user sessions. This is a classic stored XSS vulnerability where user-supplied input from the filter field is rendered without proper encoding or validation, enabling arbitrary JavaScript execution within the security context of the victim's browser session.

RemediationAI

The primary remediation is to upgrade to Juniper Networks Junos Space version 24.1R5 Patch V3 or later, which contains the fix for input sanitization in the list filter field. Organizations unable to immediately patch should implement compensating controls including: restricting network access to Junos Space management interfaces via firewall rules or VPN, implementing reverse proxy filtering to detect and block script injections in filter parameters, and enforcing strict Content-Security-Policy (CSP) headers if administratively feasible. Detailed patch availability and upgrade procedures are documented in Juniper Networks advisory JSA106003 (https://kb.juniper.net/JSA106003).