EUVD-2026-21095
GHSA-fc25-pm3m-2gqh
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Amber
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Amber
Lifecycle Timeline
7DescriptionCVE.org
An Execution with Unnecessary Privileges vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to gain root privileges, thus compromising the system.
When a configuration that allows unsigned Python op scripts is present on the device, a non-root user is able to execute malicious op scripts as a root-equivalent user, leading to privilege escalation.
This issue affects Junos OS:
- All versions before 22.4R3-S7,
- from 23.2 before 23.2R2-S4,
- from 23.4 before 23.4R2-S6,
- from 24.2 before 24.2R1-S2, 24.2R2,
- from 24.4 before 24.4R1-S2, 24.4R2;
Junos OS Evolved:
- All versions before 22.4R3-S7-EVO,
- from 23.2 before 23.2R2-S4-EVO,
- from 23.4 before 23.4R2-S6-EVO,
- from 24.2 before 24.2R2-EVO,
- from 24.4 before 24.4R1-S1-EVO, 24.4R2-EVO.
AnalysisAI
Local privilege escalation in Juniper Networks Junos OS and Junos OS Evolved allows low-privileged authenticated users to execute arbitrary code with root privileges. When unsigned Python operation scripts are enabled in device configuration, attackers can inject and execute malicious op scripts under root-equivalent context, achieving complete system compromise. Affects all Junos OS versions before 22.4R3-S7 and multiple branches through 24.4, plus corresponding Junos OS Evolved releases. No public exploit identified at time of analysis. CVSS 8.5 (High) with local attack vector requiring low privileges and no user interaction.
Technical ContextAI
Root cause is improper privilege management (CWE-250) in Python op script execution framework. When device configuration permits unsigned Python scripts, the execution context fails to enforce proper privilege separation, granting root-level permissions to scripts invoked by non-root users. This violates least-privilege principles in Junos OS scripting subsystem across both traditional and Evolved platforms.
RemediationAI
Vendor-released patches available across multiple release branches. For Junos OS, upgrade to 22.4R3-S7, 23.2R2-S4, 23.4R2-S6, 24.2R2, or 24.4R2 depending on current release train. For Junos OS Evolved, apply 22.4R3-S7-EVO, 23.2R2-S4-EVO, 23.4R2-S6-EVO, 24.2R2-EVO, or 24.4R2-EVO. Immediately disable unsigned Python op script execution in device configuration as interim mitigation if upgrade cannot be performed immediately. Review and restrict Python script permissions to trusted administrators only. Audit existing op scripts for unauthorized modifications. Comprehensive advisory and upgrade guidance available at https://kb.juniper.net/JSA103142. Organizations running affected versions should prioritize patching due to complete system compromise potential.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-250 – Execution with Unnecessary Privileges
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today