Junos OS: Authentication bypass in J-Web enables full device takeover

Summary

An improper authentication flaw in the J-Web management interface and its NETCONF session handling affects Junos OS and Junos OS Evolved. An unauthenticated network attacker who can reach the J-Web HTTP or HTTPS service can obtain root-level configuration access and take over the device. The attack requires that web management is enabled on the device and that the service is reachable from the attacker's network.

Affected

• Junos OS: 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2 (default configuration unaffected)
• Junos OS Evolved: 25.2 before 25.2R2-S2-EVO; 25.4 before 25.4R1-S3-EVO; 26.2 before 26.2R1-S2-EVO; 23.4X100; 25.2X100 before 25.2X100-D35-EVO; 25.4X300 before 25.4X300-D40-EVO (default configuration unaffected)
• Only devices with web management enabled (system services web-management) are affected.
• Unclear: the status of 23.4X100 (Evolved) is not confirmed; no fixed build was found in the sources.
• Conflicting reports list older branches (23.2, 23.4, 24.2, 24.4); these appear to belong to CVE-2026-101986. Check the advisory for your exact branch.

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and later
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and later
• Verify the exact builds in Juniper advisory JSA112187.

Workaround

Unknown. Juniper's CNA record states there are no known workarounds. Third-party guidance recommends disabling J-Web where it is not needed and restricting access to trusted administration networks; this is not confirmed by Juniper for this CVE.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Not listed in the CISA KEV catalog according to a third-party source; recheck the live catalog.
• No public proof-of-concept found.

Our recommendation

• Inventory all Junos OS and Junos OS Evolved devices and their versions, and check whether web management is enabled.
• Disable J-Web or restrict HTTP/HTTPS management access to trusted administration networks now, especially on devices reachable from WAN or guest networks.
• Upgrade to the fixed builds listed in JSA112187, starting with internet-reachable devices.
• Monitor for unexpected configuration changes and new administrative accounts.
• Recheck the advisory and KEV status before closing the ticket.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• CCB Belgium advisory on Juniper Junos OS vulnerabilities ccb.belgium.be
• CSA Singapore alert AL-2026-146 www.csa.gov.sg
• OpenCVE entry CVE-2026-101954 app.opencve.io
• ThreatInt CVE entry CVE-2026-101954 cve.threatint.com
• Positive Technologies PT-2026-113807 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:50.