EUVD-2026-21093
GHSA-w5q7-9fqr-f6hx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal authenticated user accesses system
-
ExploitBypass FPC authentication mechanism
-
ExecutionExecute high-privileged commands on FPC
-
ImpactCompromise FPC component fully
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to Juniper PTX10004, PTX10008, or PTX10016 running Junos OS Evolved with JNP10K-LC1201 or JNP10K-LC2 line cards installed. Attacker must be authenticated with low-privilege local user account on the device. Affects versions before 21.2R3-S8-EVO. |
| Impact | CVSS 8.5 reflects high impact (confidentiality, integrity compromised) via local authenticated access to PTX Series routing concentrators. Privilege escalation from low to high within FPC components enables full component compromise. Applies to specific hardware/software combinations with defined patch versions. Enterprise backbone routers are high-value targets; blast radius limited to local access and specific platforms. |
| Exploit ScenarioDerived | Authenticated local user executes privilege escalation exploit against FPC management interface, bypassing authentication controls (CWE-306). Attacker gains high-privileged FPC access, enabling control of packet forwarding/processing logic. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Local privilege escalation in Juniper Networks Junos OS Evolved on PTX Series routers allows authenticated users with low privileges to gain high-privileged direct access to Flexible PIC Concentrators (FPCs), enabling potential full compromise of affected line cards. Impacts PTX10004, PTX10008, PTX10016 with JNP10K-LC1201 or JNP10K-LC1202 line cards across multiple firmware branches. Missing authentication on critical FPC management functions permits unauthorized privilege elevation. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patches: upgrade to 21.2R3-S8-EVO, 21.4R3-S7-EVO, 22.2R3-S4-EVO, 22.3R3-S3-EVO, 22.4R3-S2-EVO, or 23.2R2-EVO depending on current branch. Verify installed line card models match JNP10K-LC1201 or JNP10K-LC1202 to confirm applicability. Restrict local user access via role-based access controls and monitor FPC access logs for anomalous privilege escalation attempts. Implement principle of least privilege for all local accounts. Full technical details and upgrade procedures available in Juniper security advisory https://kb.juniper.net/JSA107806. No effective workarounds exist; patching is required to eliminate the authentication bypass.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is CWE-306 (Missing Authentication for Critical Function) in FPC access control mechanisms. Local users bypass authentication checks for direct FPC interaction, escalating from low to high privileges within the chassis subsystem. Affects Junos OS Evolved's FPC management layer on specific PTX hardware platforms equipped with JNP10K-LC1201/LC1202 line cards.
Know when Junos Os Evolved gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:M
Primary rating from Vendor (juniper) · only source for this CVE.
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A Missing Authentication for Critical Function vulnerability in the Flexible PIC Concentrators (FPCs) of Juniper Networks Junos OS Evolved on PTX Series allows a local, authenticated attacker with low privileges to gain direct access to FPCs installed in the device.
A local user with low privileges can gain direct access to the installed FPCs as a high privileged user, which can potentially lead to a full compromise of the affected component.
This issue affects Junos OS Evolved on PTX10004, PTX10008, PTX100016, with JNP10K-LC1201 or JNP10K-LC1202:
- All versions before 21.2R3-S8-EVO,
- 21.4-EVO versions before 21.4R3-S7-EVO,
- 22.2-EVO versions before 22.2R3-S4-EVO,
- 22.3-EVO versions before 22.3R3-S3-EVO,
- 22.4-EVO versions before 22.4R3-S2-EVO,
- 23.2-EVO versions before 23.2R2-EVO.
Executive ViewAI
Juniper Networks Junos OS Evolved contains a local privilege escalation vulnerability affecting PTX Series routers that allows low-privileged authenticated users to gain administrative access to line card hardware, potentially compromising network traffic processing and device integrity. Organizations operating PTX10004, PTX10008, or PTX10016 routers must prioritize mitigation to prevent insider threats and unauthorized control of critical routing infrastructure.
Apply vendor patch. Interim mitigations pending patch deployment: restrict console and SSH access to trusted administrators only, implement role-based access controls to limit low-privileged user accounts on affected routers, and disable FPC management interfaces where operationally feasible until patched.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Junos Os Evolved
View allAn Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an
An unauthenticated attacker on an adjacent Layer 2 segment can sustain a denial-of-service condition against Juniper Jun
An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allow
Unauthenticated OS command injection in Juniper Networks Junos OS Evolved's bootzd zero-touch provisioning (ZTP) daemon
An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protoc
Authenticated, low-privileged TACACS+ users on Juniper Networks Junos OS Evolved can escalate to root and execute arbitr
A Missing Release of File Descriptor or Handle after Effective Lifetime vulnerability in plugable authentication module
Unauthenticated OS command injection in the bootzd zero-touch provisioning (ZTP) daemon of Juniper Networks Junos OS Evo
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Exploit-DB