CVE-2026-101954 — Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled

Description (CNA)

An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.

Affected (CNA)

Vendor / product	Versions
Juniper Networks / Junos OS	affected 25.2 before 25.2R2-S2; affected 25.4 before 25.4R1-S3; affected 26.2 before 26.2R1-S2
Juniper Networks / Junos OS Evolved	affected 25.2 before 25.2R2-S2-EVO; affected 25.4 before 25.4R1-S3-EVO; affected 26.2 before 26.2R1-S2-EVO; affected 23.4X100; affected 25.2X100 before 25.2X100-D35-EVO; affected 25.4X300 before 25.4X300-D40-EVO

CWE

CWE-287

References

https://supportportal.juniper.net/JSA112187

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.