Juniper Junos OS: Authentication bypass in J-Web enables CGI execution

Summary

J-Web, the web management interface of Juniper Junos OS and Junos OS Evolved devices, contains an improper authentication flaw (CWE-287). An unauthenticated network attacker can bypass J-Web authentication with a crafted HTTP request and execute CGI content with elevated privileges. The attack requires that J-Web is enabled and reachable over HTTP or HTTPS from the attacker's network position. Juniper SIRT is not aware of any malicious exploitation.

Affected

• Junos OS: 0 to < 23.2R2-S7.7; 23.4 to < 23.4R2-S8.13; 24.2 to < 24.2R2-S5.5; 24.4 to < 24.4R2-S5; 25.2 to < 25.2R2-S2; 25.4 to < 25.4R1-S3; 26.2 to < 26.2R1-S2 (default: unaffected)
• Junos OS Evolved: 0 to < 23.2R2-S7.7-EVO; 23.4 to < 23.4R2-S8.11-EVO; 24.2 to < 24.2R2-S5.6-EVO; 24.4 to < 24.4R2-S5-EVO; 25.2 to < 25.2R2-S2-EVO; 25.4 to < 25.4R1-S3-EVO; 26.2 to < 26.2R1-S2-EVO; plus X-train builds 23.4X100, 25.2X100 to < 25.2X100-D35-EVO and 25.4X300 to < 25.4X300-D40-EVO (default: unaffected)

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
• Verify the fixed builds against Juniper advisory JSA112187 before scheduling changes.

Workaround

Unknown. Juniper states there are no known workarounds.

• Restricting access to J-Web with firewall or ACL rules mitigates exposure but does not remove the flaw.
• Disabling J-Web on devices where it is not needed removes this attack path.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
• No public proof-of-concept was found in the research, but this does not prove that none exists.
• Earlier J-Web flaws (2023) were chained by attackers to achieve unauthenticated remote code execution on EX switches and SRX firewalls.

Our recommendation

• Inventory all Junos OS and Junos OS Evolved devices and check whether J-Web is enabled and reachable.
• Disable J-Web or restrict it to a management VLAN or jump host now.
• Check the installed version against JSA112187 and schedule the fixed build.
• Review logs for unexpected CGI requests or administrative sessions on J-Web-enabled devices.
• Treat CVE-2026-101956 and CVE-2026-101954, published the same day, as part of the same review.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper advisory JSA112187 supportportal.juniper.net
• OpenCVE CVE-2026-101986 app.opencve.io
• Singapore CSA alert AL-2026-146 www.csa.gov.sg
• Vulnrichment CVE-2026-101986 vulners.com
• Analysis of J-Web authentication failures (dev.to) dev.to
• Mallory: J-Web exploitation precedent mallory.ai
• Sentinelone CVE-2023-36844 (earlier J-Web flaw) www.sentinelone.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:58.