CVE-2026-21904

Analyzed Analyzed - Analysis Complete

Cross-Site Scripting in Juniper Junos Space Enables Admin Command Execution

Publication date: 2026-04-09

Last updated on: 2026-07-08

Assigner: Juniper Networks, Inc.

Description

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the list filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R5 Patch V3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-07-08

Generated

2026-07-26

AI Q&A

2026-04-10

EPSS Evaluated

2026-07-25

NVD

CVE-2026-21904

EUVD

EUVD-2026-21077

Affected Vendors & Products

Vendor	Product	Version / Range
juniper	junos_space	1.4
juniper	junos_space	1.0
juniper	junos_space	12.3
juniper	junos_space	1.3
juniper	junos_space	12.1
juniper	junos_space	11.3
juniper	junos_space	11.2
juniper	junos_space	1.1
juniper	junos_space	1.2
juniper	junos_space	2.0
juniper	junos_space	11.1
juniper	junos_space	12.2
juniper	junos_space	11.4
juniper	junos_space	13.3
juniper	junos_space	13.3
juniper	junos_space	14.1
juniper	junos_space	14.1
juniper	junos_space	15.1
juniper	junos_space	15.1
juniper	junos_space	15.2
juniper	junos_space	16.1
juniper	junos_space	16.1
juniper	junos_space	17.1
juniper	junos_space	16.1
juniper	junos_space	14.1
juniper	junos_space	13.3
juniper	junos_space	13.3
juniper	junos_space	13.3
juniper	junos_space	13.3
juniper	junos_space	13.3
juniper	junos_space	13.3
juniper	junos_space	13.3
juniper	junos_space	13.3
juniper	junos_space	18.1r1
juniper	junos_space	13.3
juniper	junos_space	14.1
juniper	junos_space	15.1
juniper	junos_space	16.1
juniper	junos_space	15.2
juniper	junos_space	17.2
juniper	junos_space	13.1
juniper	junos_space	13.1
juniper	junos_space	15.1
juniper	junos_space	17.1
juniper	junos_space	17.2
juniper	junos_space	18.1
juniper	junos_space	18.2
juniper	junos_space	18.3
juniper	junos_space	18.4
juniper	junos_space	19.1
juniper	junos_space	24.1
juniper	junos_space	24.1
juniper	junos_space	24.1
juniper	junos_space	24.1
juniper	junos_space	24.1
juniper	junos_space	22.2
juniper	junos_space	23.1
juniper	junos_space	13.3
juniper	junos_space	13.3
juniper	junos_space	16.1
juniper	junos_space	16.1r3
juniper	junos_space	20.3
juniper	junos_space	21.1
juniper	junos_space	21.2
juniper	junos_space	21.3
juniper	junos_space	22.1
juniper	junos_space	22.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross-site Scripting (XSS) issue in Juniper Networks Junos Space. It occurs because the software does not properly neutralize input during web page generation, specifically in the list filter field. An attacker can inject malicious script tags into this field.

When another user visits the affected page with the injected script, the attacker can execute commands with the permissions of that user, including administrator-level permissions.

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary commands with the permissions of the user who views the injected script. If the victim is an administrator, the attacker can gain administrative control, potentially leading to unauthorized access, data manipulation, or disruption of services.

Hi! I’m here to help you understand CVE-2026-21904. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70