CVE-2026-101954

Awaiting Analysis Awaiting Analysis - Queue

Improper Authentication in Juniper Junos OS and Junos OS Evolved

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Juniper Networks, Inc.

Description

An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101954

EUVD

EUVD-2026-101494

Affected Vendors & Products

Vendor	Product	Version / Range
Juniper	Networks	Junos OS 25.2
Juniper	Networks	Junos OS 25.4
Juniper	Networks	Junos OS 26.2
Juniper	Networks	Junos OS Evolved 25.2
Juniper	Networks	Junos OS Evolved 25.4
Juniper	Networks	Junos OS Evolved 26.2
Juniper	Networks	Junos OS Evolved 23.4X100
Juniper	Networks	Junos OS Evolved 25.2X100
Juniper	Networks	Junos OS Evolved 25.4X300

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Authentication issue in Juniper Networks Junos OS and Junos OS Evolved. It affects the J-Web management interface and NETCONF session handling. An unauthenticated attacker can exploit it to gain root-level access to the device configuration and take over the device if the J-Web HTTP or HTTPS service is reachable and web management is enabled.

Detection Guidance

Check if the J-Web HTTP or HTTPS service is enabled on Juniper devices by running 'show system services web-management' or 'show configuration system services web-management'. Scan for open ports 80 (HTTP) or 443 (HTTPS) on affected devices. Verify if NETCONF sessions are active with 'show system connections | match 830'.

Impact Analysis

An attacker could gain full control over your network device, allowing them to view, modify, or delete sensitive configurations. This could lead to network outages, data breaches, or unauthorized access to other systems connected to the device.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. It may result in data breaches, loss of data integrity, and failure to meet security control standards.

Mitigation Strategies

Disable J-Web management interface if not needed using 'set system services web-management disable'. Restrict access to J-Web by configuring firewall rules to allow only trusted IPs. Update Junos OS to the latest patched version immediately.

Hi! I’m here to help you understand CVE-2026-101954. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70