Juniper Networks

CVE	Summary	Severity	CVSS	EPSS	Priority
CVE-2026-101967	Unauthenticated OS command injection in Juniper Networks Junos OS Evolved's bootzd zero-touch provisioning (ZTP) daemon allows adjacent attackers on the management LAN to execute arbitrary commands as root via a crafted DHCP response. The vulnerability has a CVSS 4.0 base score of 9.3 and requires the target device to be actively in ZTP mode; no public exploit code is identified at time of analysis.	CRITICAL	9.3	3.9%	50
CVE-2026-103406	Unauthenticated remote command execution as root affects Juniper Networks Session Smart Conductor through its Salt-based AutomatedProvisioner: a crafted salt minion ID containing shell special characters is not neutralized before being used in an OS command. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, an attacker who can reach the Conductor's provisioning interface needs no credentials and no user interaction, and the injected commands execute with root privileges. No public exploit or CISA KEV entry is identified at time of analysis, but the 9.8 vendor-reported severity and the act_now priority label make reachable management interfaces a high-priority exposure.	CRITICAL	9.8	–	49
CVE-2026-103409	Juniper Networks Session Smart Router exposes an insecure endpoint that runs as root and performs no authentication check, letting a remote attacker who can reach it obtain administrative privileges by passing crafted URL parameters. Per the CVSS vector the attack is network-reachable, unauthenticated (PR:N) and requires no user interaction, so severity is rated 9.8 - but exploitability is gated by deployment state: only devices that have not yet been onboarded to Mist or Conductor are exposed, and the endpoint becomes unreachable once onboarding completes. No KEV listing or public exploit reference appears in the supplied intelligence, so no public exploit identified at time of analysis; the vulnerability is nevertheless tracked as act_now priority because of the pre-auth root-level impact within the pre-onboarding window.	CRITICAL	9.8	–	49
CVE-2026-102031	Authenticated, low-privileged TACACS+ users on Juniper Networks Junos OS Evolved can escalate to root and execute arbitrary OS commands, but only when the periodic TACACS+ authorization-refresh feature is enabled - an OS command injection flaw (CWE-78) that requires both a valid low-privileged TACACS+ account and that specific configuration to be active. The vendor rates it 9.3, while our independent assessment scores it CVSS:3.1 9.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting that exploitation is not possible by an anonymous remote attacker despite the vendor's PR:N vector. There is no public exploit identified at time of analysis, and the flaw does not trigger on devices using TACACS+ without authorization-refresh, or on devices using RADIUS or local authentication.	CRITICAL	9.3	2.1%	49
CVE-2026-101978	Unauthenticated OS command injection in the bootzd zero-touch provisioning (ZTP) daemon of Juniper Networks Junos OS Evolved on PTX Series routers allows an attacker positioned on the management LAN to execute arbitrary commands as root by sending a crafted gRPC response to a device that is actively provisioning. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting low attack complexity, no authentication or user interaction requirements, and full confidentiality, integrity, and availability impact; the adjacent-network attack vector (AV:A) means the device is not exploitable directly from the internet. No public exploit code has been identified at time of analysis, no CISA KEV listing or EPSS score was provided, and exposure is materially reduced where management traffic runs over a segmented or physically isolated out-of-band network and where devices are not in an active ZTP state.	HIGH	8.7	3.9%	47
CVE-2026-102059	OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, unauthenticated attacker who operates a rogue DHCP server execute arbitrary commands as root on affected EX Series, SRX Series, and QFX Series devices. Exploitation is not remotely routable: the attacker must share a Layer-2 broadcast domain with the target and the device must be actively running phone-home / zero-touch provisioning (ZTP), which is why an independent assessment rates the attack complexity higher than the vendor's 8.7 score despite the high confidentiality, integrity, and availability impact (PR:N/UI:N once those conditions hold). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV entry), though NVIDIA/ENISA EUVD tracking and a full Juniper advisory (JSA112187) with vendor patches indicate this is a genuinely high-priority, patchable issue.	HIGH	8.7	3.9%	47
CVE-2026-101956	Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-Web web management interface. An attacker who can reach the J-Web HTTP/HTTPS interface can bypass authentication due to an improper authentication flaw (CWE-287) and execute arbitrary Junos commands as root, with no credentials or user interaction required. The CVSS 4.0 score is 9.3 and our independent CVSS 3.1 assessment is 9.8; no public exploit code has been identified at time of analysis, but exposure is critical for any internet-facing or broadly reachable J-Web service.	CRITICAL	9.3	0.7%	47
CVE-2026-102175	Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause a denial of service via a crafted TCP frame. Exploitation requires the optional SDX/SRC service-deployment feature to be configured and the attacker to hold a man-in-the-middle position on that path (or control/spoof the SDX/SRC server), conditions that significantly limit real-world exposure; no public exploit has been identified at time of analysis. Juniper has issued patches in advisory JSA112187, and the vendor's CVSS 4.0 score of 9.3 is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1).	CRITICAL	9.3	0.7%	47
CVE-2026-33792	A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, remote attacker execute code as root or crash the device by sending a crafted packet through a configured GRE tunnel. The only meaningful precondition is that a GRE tunnel must be configured and the malformed packet must arrive on that tunnel interface, so SRX deployments without GRE are not exposed; where GRE is enabled the attack is network-reachable, requires no credentials and no user interaction, and the independent assessment rates the resulting impact as high across confidentiality, integrity and availability. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but vendor patches are available and the configuration-dependent exposure makes rapid triage of GRE-enabled SRX fleets worthwhile.	CRITICAL	9.3	0.6%	47
CVE-2026-101986	Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved through the J-Web management interface. An attacker who can reach J-Web can send a crafted HTTP request to bypass authentication and execute CGI content with high confidentiality, integrity, and availability impact; the CVSS v4 base score is 9.3 and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and the primary risk factor is exposure of J-Web to untrusted or internet-facing networks, since devices with J-Web disabled or restricted to a management network are not reachable.	CRITICAL	9.3	0.6%	47
CVE-2026-101990	Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-based buffer overflow in Juniper Networks routing protocol daemon (rpd). A remote configured BGP peer can trigger it by sending a flow-spec update that is selected for re-advertisement; exploitation requires an existing BGP peering relationship and the relevant flow-spec re-advertisement configuration. Rated Critical (CVSS 4.0 base 9.3), Junos OS can be compromised for code execution while Junos OS Evolved is limited to an rpd crash, and no public exploit identified at time of analysis.	CRITICAL	9.3	0.6%	47
CVE-2026-101982	Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid EVPN route advertisements sent by an established BGP/EVPN peer for a configured EVPN-VPWS service, while the identical input causes only an rpd crash (denial of service) on Junos OS Evolved. The underlying defect is a stack-based buffer overflow (CWE-121) in a daemon that runs with root privileges on FreeBSD-based Junos OS, so a successful overflow yields full device compromise, and Juniper has published patched builds under advisory JSA112187. The vendor's CVSS 4.0 base is 9.3 with AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, but real exposure is gated by the requirement that the attacker already hold a configured BGP/EVPN adjacency to the target device; no public exploit code has been identified at time of analysis and there is no KEV confirmation of active exploitation.	CRITICAL	9.3	0.6%	47
CVE-2026-33796	Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routing protocol daemon (rpd) processes crafted BMP route monitoring messages from a configured external BGP neighbor. Exploitation requires the target device to have an established external BGP (eBGP) session with the attacker-controlled peer and BMP route monitoring enabled; routers without BMP configured or without eBGP peers are not exposed. No public exploit code or active exploitation has been identified at time of analysis.	CRITICAL	9.3	0.6%	47
CVE-2026-101983	Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based buffer overflow (CWE-121) in the httpd process that serves the J-Web management interface, reachable by an unauthenticated network attacker who can reach the J-Web HTTP(S) listener. The vendor-assigned CVSS 4.0 score is 9.3 (and our independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. 9.8), reflecting full confidentiality, integrity and availability impact with no authentication or user interaction required; attack complexity is low in the base vector, though the real-world exploitable population is constrained by two configuration prerequisites. Successful exploitation is contingent on J-Web being enabled and a J-Web virtual-domain being configured - a non-default state - so devices with J-Web disabled or no virtual-domain configured are not affected. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.	CRITICAL	9.3	0.5%	47
CVE-2026-101954	Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Junos OS Evolved devices through the J-Web management interface when web management is enabled, due to improper authentication in NETCONF session handling. This is a critical vulnerability (CVSS 9.3/9.8) that requires only network reachability to the J-Web HTTP/HTTPS service; no credentials or user interaction are needed. No public exploit code or active exploitation has been identified at time of analysis, but the risk is genuine and high-priority as noted in independent assessment, not merely a high-CVSS artifact.	CRITICAL	9.3	0.5%	47

CVE-2026-101967

Unauthenticated OS command injection in Juniper Networks Junos OS Evolved's bootzd zero-touch provisioning (ZTP) daemon allows adjacent attackers on the management LAN to execute arbitrary commands as root via a crafted DHCP response. The vulnerability has a CVSS 4.0 base score of 9.3 and requires the target device to be actively in ZTP mode; no public exploit code is identified at time of analysis.

CRITICAL

9.3

3.9%

50

CVE-2026-103406

Unauthenticated remote command execution as root affects Juniper Networks Session Smart Conductor through its Salt-based AutomatedProvisioner: a crafted salt minion ID containing shell special characters is not neutralized before being used in an OS command. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, an attacker who can reach the Conductor's provisioning interface needs no credentials and no user interaction, and the injected commands execute with root privileges. No public exploit or CISA KEV entry is identified at time of analysis, but the 9.8 vendor-reported severity and the act_now priority label make reachable management interfaces a high-priority exposure.

CRITICAL

9.8

–

49

CVE-2026-103409

Juniper Networks Session Smart Router exposes an insecure endpoint that runs as root and performs no authentication check, letting a remote attacker who can reach it obtain administrative privileges by passing crafted URL parameters. Per the CVSS vector the attack is network-reachable, unauthenticated (PR:N) and requires no user interaction, so severity is rated 9.8 - but exploitability is gated by deployment state: only devices that have not yet been onboarded to Mist or Conductor are exposed, and the endpoint becomes unreachable once onboarding completes. No KEV listing or public exploit reference appears in the supplied intelligence, so no public exploit identified at time of analysis; the vulnerability is nevertheless tracked as act_now priority because of the pre-auth root-level impact within the pre-onboarding window.

CRITICAL

9.8

–

49

CVE-2026-102031

Authenticated, low-privileged TACACS+ users on Juniper Networks Junos OS Evolved can escalate to root and execute arbitrary OS commands, but only when the periodic TACACS+ authorization-refresh feature is enabled - an OS command injection flaw (CWE-78) that requires both a valid low-privileged TACACS+ account and that specific configuration to be active. The vendor rates it 9.3, while our independent assessment scores it CVSS:3.1 9.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting that exploitation is not possible by an anonymous remote attacker despite the vendor's PR:N vector. There is no public exploit identified at time of analysis, and the flaw does not trigger on devices using TACACS+ without authorization-refresh, or on devices using RADIUS or local authentication.

CRITICAL

9.3

2.1%

49

CVE-2026-101978

Unauthenticated OS command injection in the bootzd zero-touch provisioning (ZTP) daemon of Juniper Networks Junos OS Evolved on PTX Series routers allows an attacker positioned on the management LAN to execute arbitrary commands as root by sending a crafted gRPC response to a device that is actively provisioning. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting low attack complexity, no authentication or user interaction requirements, and full confidentiality, integrity, and availability impact; the adjacent-network attack vector (AV:A) means the device is not exploitable directly from the internet. No public exploit code has been identified at time of analysis, no CISA KEV listing or EPSS score was provided, and exposure is materially reduced where management traffic runs over a segmented or physically isolated out-of-band network and where devices are not in an active ZTP state.

HIGH

8.7

3.9%

47

CVE-2026-102059

OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, unauthenticated attacker who operates a rogue DHCP server execute arbitrary commands as root on affected EX Series, SRX Series, and QFX Series devices. Exploitation is not remotely routable: the attacker must share a Layer-2 broadcast domain with the target and the device must be actively running phone-home / zero-touch provisioning (ZTP), which is why an independent assessment rates the attack complexity higher than the vendor's 8.7 score despite the high confidentiality, integrity, and availability impact (PR:N/UI:N once those conditions hold). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV entry), though NVIDIA/ENISA EUVD tracking and a full Juniper advisory (JSA112187) with vendor patches indicate this is a genuinely high-priority, patchable issue.

HIGH

8.7

3.9%

47

CVE-2026-101956

Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-Web web management interface. An attacker who can reach the J-Web HTTP/HTTPS interface can bypass authentication due to an improper authentication flaw (CWE-287) and execute arbitrary Junos commands as root, with no credentials or user interaction required. The CVSS 4.0 score is 9.3 and our independent CVSS 3.1 assessment is 9.8; no public exploit code has been identified at time of analysis, but exposure is critical for any internet-facing or broadly reachable J-Web service.

CRITICAL

9.3

0.7%

47

CVE-2026-102175

Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause a denial of service via a crafted TCP frame. Exploitation requires the optional SDX/SRC service-deployment feature to be configured and the attacker to hold a man-in-the-middle position on that path (or control/spoof the SDX/SRC server), conditions that significantly limit real-world exposure; no public exploit has been identified at time of analysis. Juniper has issued patches in advisory JSA112187, and the vendor's CVSS 4.0 score of 9.3 is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1).

CRITICAL

9.3

0.7%

47

CVE-2026-33792

A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, remote attacker execute code as root or crash the device by sending a crafted packet through a configured GRE tunnel. The only meaningful precondition is that a GRE tunnel must be configured and the malformed packet must arrive on that tunnel interface, so SRX deployments without GRE are not exposed; where GRE is enabled the attack is network-reachable, requires no credentials and no user interaction, and the independent assessment rates the resulting impact as high across confidentiality, integrity and availability. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but vendor patches are available and the configuration-dependent exposure makes rapid triage of GRE-enabled SRX fleets worthwhile.

CRITICAL

9.3

0.6%

47

CVE-2026-101986

Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved through the J-Web management interface. An attacker who can reach J-Web can send a crafted HTTP request to bypass authentication and execute CGI content with high confidentiality, integrity, and availability impact; the CVSS v4 base score is 9.3 and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and the primary risk factor is exposure of J-Web to untrusted or internet-facing networks, since devices with J-Web disabled or restricted to a management network are not reachable.

CRITICAL

9.3

0.6%

47

CVE-2026-101990

Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-based buffer overflow in Juniper Networks routing protocol daemon (rpd). A remote configured BGP peer can trigger it by sending a flow-spec update that is selected for re-advertisement; exploitation requires an existing BGP peering relationship and the relevant flow-spec re-advertisement configuration. Rated Critical (CVSS 4.0 base 9.3), Junos OS can be compromised for code execution while Junos OS Evolved is limited to an rpd crash, and no public exploit identified at time of analysis.

CRITICAL

9.3

0.6%

47

CVE-2026-101982

Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid EVPN route advertisements sent by an established BGP/EVPN peer for a configured EVPN-VPWS service, while the identical input causes only an rpd crash (denial of service) on Junos OS Evolved. The underlying defect is a stack-based buffer overflow (CWE-121) in a daemon that runs with root privileges on FreeBSD-based Junos OS, so a successful overflow yields full device compromise, and Juniper has published patched builds under advisory JSA112187. The vendor's CVSS 4.0 base is 9.3 with AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, but real exposure is gated by the requirement that the attacker already hold a configured BGP/EVPN adjacency to the target device; no public exploit code has been identified at time of analysis and there is no KEV confirmation of active exploitation.

CRITICAL

9.3

0.6%

47

CVE-2026-33796

Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routing protocol daemon (rpd) processes crafted BMP route monitoring messages from a configured external BGP neighbor. Exploitation requires the target device to have an established external BGP (eBGP) session with the attacker-controlled peer and BMP route monitoring enabled; routers without BMP configured or without eBGP peers are not exposed. No public exploit code or active exploitation has been identified at time of analysis.

CRITICAL

9.3

0.6%

47

CVE-2026-101983

Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based buffer overflow (CWE-121) in the httpd process that serves the J-Web management interface, reachable by an unauthenticated network attacker who can reach the J-Web HTTP(S) listener. The vendor-assigned CVSS 4.0 score is 9.3 (and our independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. 9.8), reflecting full confidentiality, integrity and availability impact with no authentication or user interaction required; attack complexity is low in the base vector, though the real-world exploitable population is constrained by two configuration prerequisites. Successful exploitation is contingent on J-Web being enabled and a J-Web virtual-domain being configured - a non-default state - so devices with J-Web disabled or no virtual-domain configured are not affected. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.

CRITICAL

9.3

0.5%

47

CVE-2026-101954

Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Junos OS Evolved devices through the J-Web management interface when web management is enabled, due to improper authentication in NETCONF session handling. This is a critical vulnerability (CVSS 9.3/9.8) that requires only network reachability to the J-Web HTTP/HTTPS service; no credentials or user interaction are needed. No public exploit code or active exploitation has been identified at time of analysis, but the risk is genuine and high-priority as noted in independent assessment, not merely a high-CVSS artifact.

CRITICAL

9.3

0.5%

47

Severity Breakdown

Monthly CVE Trend

Affected Products (8)

Top Risky CVEs