Junos OS Evolved EUVD-2026-101356

Two concrete prerequisites must both hold: (1) the device must have periodic TACACS+ authorization-refresh enabled - the flaw does not trigger without this feature active; and (2) the attacker must possess valid low-privileged TACACS+ credentials to be an authenticated user on the device. Limiting factors that reduce real-world risk: exploitation is impossible on devices using TACACS+ without authorization-refresh or using other authentication backends (RADIUS/local), and it requires prior valid authentication, so it is not exploitable by a fully anonymous remote attacker despite the PR:N claim in the vendor vector. Affected product is Juniper Networks Junos OS Evolved; classic Junos is not named in the provided data.

This is a genuine high-priority issue, but its real-world reach is gated by a specific configuration. The vendor-supplied CVSS 4.0 score of 9.3 reflects high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with a network vector and low complexity. However, two signals conflict and must be reconciled: the CVSS vector lists PR:N (no privileges required), while the description explicitly requires a 'low-privileged TACACS+-authenticated user' - the description is almost certainly correct, so exploitation requires valid TACACS+ credentials, not fully unauthenticated access. This materially lowers the practical risk versus a pure PR:N network flaw. Furthermore, the flaw only triggers 'when periodic TACACS+ authorization-refresh is enabled,' a non-default-sounding condition that narrows the exposed population. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a serious privilege-escalation-to-root bug (CWE-78) worth prioritizing for environments using Juniper TACACS+ with authorization-refresh, but not an indiscriminate internet-facing threat - the credential requirement and configuration dependency make it targeted rather than mass-exploitable.

An attacker who already holds low-privileged TACACS+ credentials on a Junos OS Evolved device (for example a limited NOC operator account) targets a device where periodic TACACS+ authorization-refresh is enabled. During an authorization-refresh cycle the attacker supplies crafted input that is passed unsafely to an OS command, causing arbitrary commands to run with root privileges. No public proof-of-concept exploit was provided in the available intelligence.