EUVD-2026-21080
GHSA-x5g9-73r3-vh5h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticated user executes 'file link' CLI operation
-
DeliveryAnother user commits unrelated configuration changes
-
ExploitSymlink race condition exploited
-
ExecutionFirst user logs in as root
-
ImpactComplete system compromise achieved
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling UNIX symlink resolution
|
| Exploitation Conditions | Local authenticated attacker with low privileges on Juniper Junos OS. Requires executing 'file link ...' CLI operation, then a different user must commit unrelated configuration changes. Affects Junos OS versions before 23.2R2-S7, 23.4 before 23.4R2-S6, 24.2 before 24.2R2-S3, 24.4 before 24.4R2-S2, and 25.2. |
| Impact | Local privilege escalation requiring authenticated access and user interaction (symlink race condition during CLI commit). CVSS 7.0 reflects high confidentiality/integrity impact but limited scope. Moderate observed exploitation activity. Affects Junos versions spanning 23.2-25.1; organizations on unpatched releases face complete system compromise risk if users operate file-link CLI operations. |
| Exploit ScenarioDerived | Authenticated user executes 'file link' CLI operation, then a second user commits unrelated configuration changes, triggering symlink race condition. First user can subsequently login as root. Requires coordination timing and local system access; no public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Symbolic link manipulation in Juniper Networks Junos OS CLI enables authenticated local attackers with low privileges to escalate to root access. Exploitation requires two users: the first performs a 'file link ...' CLI operation, then after the second user commits unrelated configuration changes, the first user can authenticate as root, achieving full system compromise. Affects Junos OS versions across 23.2, 23.4, 24.2, 24.4, and 25.2 release trains prior to specified patch levels. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patches: upgrade to Junos OS 23.2R2-S7, 23.4R2-S6, 24.2R2-S3, 24.4R2-S2, 25.2R2, or migrate to 25.4R1 or later versions depending on current release train. No workarounds identified. Restrict CLI access to trusted administrators only and audit user activities involving file operations. Implement least-privilege access controls and monitor for suspicious 'file link' command usage in system logs. Immediate patching required for internet-facing management interfaces or multi-tenant environments. Advisory URL: https://kb.juniper.net/JSA107807. EPSS data not provided; prioritize based on local threat model and exposed management access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-61 symlink following flaw in Junos OS CLI file operations. Exploitation chain requires multi-user interaction: attacker-controlled symlink created via 'file link' command persists across configuration commits by other users, allowing privilege escalation upon subsequent login. Root cause involves insufficient symlink validation in CLI authentication or session handling paths during commit operations.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:M
Primary rating from Vendor (juniper) · only source for this CVE.
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system.
When after a user has performed a specific 'file link ...' CLI operation, another user commits (unrelated configuration changes), the first user can login as root.
This issue affects Junos OS:
- all versions before 23.2R2-S7,
- 23.4 versions before 23.4R2-S6,
- 24.2 versions before 24.2R2-S3,
- 24.4 versions before 24.4R2-S2,
- 25.2 versions before 25.2R2.
This issue does not affect versions 25.4R1 or later.
Executive ViewAI
CVE-2026-21916 affects Juniper Networks Junos OS and allows authenticated local users with low privileges to escalate to root access through symbolic link manipulation during configuration commits, resulting in complete system compromise across multiple current release versions. Organizations operating Juniper routing and security platforms must prioritize patching to prevent insider threats and lateral movement from compromised low-privilege accounts. This vulnerability requires coordination between two users but poses significant risk in environments with multiple administrators or service accounts.
Apply vendor patch. Interim mitigations pending patch availability: restrict CLI 'file link' command execution to administrative-only roles; implement mandatory multi-factor authentication for privileged CLI access; enable audit logging for all configuration commits and file operations; segregate administrative access to prevent low-privilege account interaction with configuration commit workflows.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB