Junos OS: Improper authentication in J-Web allows unauthenticated root commands
Summary
The J-Web web management interface of Junos OS, the operating system of Juniper routers, switches and SRX firewalls, has an improper authentication flaw (CWE-287). According to the CVE record, an unauthenticated remote attacker can execute arbitrary Junos commands with root privileges through the exposed J-Web interface, provided J-Web is enabled. Research sources disagree on how this CVE ID maps to the Juniper advisory, so JSA112188 must be checked to confirm the details.
Affected
- Junos OS 25.2 to before 25.2R2-S2
- Junos OS 25.4 to before 25.4R1-S3
- Junos OS 26.2 to before 26.2R1-S2
- Default configuration is unaffected; J-Web must be enabled.
Fixed in
- Junos OS 25.2R2-S2
- Junos OS 25.4R1-S3 and 25.4R2
- Junos OS 26.2R1-S2 and 26.2R2
- Junos OS 26.4R1 and all subsequent releases
Workaround
- No known workarounds according to the CNA record.
- If J-Web is not needed, disabling it removes this attack path. This is a general mitigation, not a vendor-confirmed workaround.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No public proof of concept was found in research; this does not prove that none exists. CISA KEV status was not verified.
Our recommendation
- Read JSA112188 and confirm the CVE ID mapping and the fixed build for each platform.
- Inventory Junos devices and check whether J-Web (system services web-management) is enabled and reachable from untrusted networks.
- If J-Web is not needed, disable it or restrict access to trusted management networks now.
- Upgrade each platform to a fixed release, then verify with a scan (for example Tenable plugin 372460).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112188 supportportal.juniper.net
- OpenCVE: CVE-2026-101956 app.opencve.io
- Vulners VulnRichment: CVE-2026-101956 vulners.com
- Tenable Nessus plugin 372460 www.tenable.com
- VulDB: vuln 420197 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:00.
Original description (NVD)
An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.