CVE-2026-101986
Awaiting Analysis Awaiting Analysis - Queue

Improper Authentication in Juniper Junos OS J-Web

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Juniper Networks, Inc.

Description
An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-101986
EUVD
EUVD-2026-101450

Affected Vendors & Products

Showing 17 associated CPEs
Vendor Product Version / Range
Juniper Networks Junos OS 0
Juniper Networks Junos OS 23.4
Juniper Networks Junos OS 24.2
Juniper Networks Junos OS 24.4
Juniper Networks Junos OS 25.2
Juniper Networks Junos OS 25.4
Juniper Networks Junos OS 26.2
Juniper Networks Junos OS Evolved 0
Juniper Networks Junos OS Evolved 23.4
Juniper Networks Junos OS Evolved 24.2
Juniper Networks Junos OS Evolved 24.4
Juniper Networks Junos OS Evolved 25.2
Juniper Networks Junos OS Evolved 25.4
Juniper Networks Junos OS Evolved 26.2
Juniper Networks Junos OS Evolved 23.4X100
Juniper Networks Junos OS Evolved 25.2X100
Juniper Networks Junos OS Evolved 25.4X300

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Authentication issue in J-Web, the web interface for Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated attacker to bypass authentication and execute CGI content with elevated privileges by sending a specially crafted HTTP request.

Detection Guidance

To detect this vulnerability, check for unauthorized access attempts to J-Web interfaces. Monitor HTTP requests for unusual CGI content execution patterns. Verify authentication logs for bypass attempts. Juniper recommends inspecting network traffic for crafted HTTP requests targeting J-Web endpoints.

Impact Analysis

An attacker could gain unauthorized access to the J-Web interface, execute arbitrary commands with high privileges, and potentially take control of the affected system. This could lead to data breaches, system compromise, or disruption of network services.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, and other regulations. Organizations could face legal penalties, reputational damage, and loss of customer trust.

Mitigation Strategies

Apply the latest security patches from Juniper Networks for Junos OS and Junos OS Evolved to address the improper authentication vulnerability in J-Web. Disable J-Web if not required or restrict access to trusted networks only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101986. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart