Juniper Junos OS Evolved: Command injection in TACACS+ authorization refresh

Summary

A command injection vulnerability in the TACACS+ component of Junos OS Evolved, the network operating system of Juniper devices, allows a low-privileged user authenticated via TACACS+ to run commands with root privileges. The flaw only applies when periodic TACACS+ authorization refresh is enabled (system tacplus-options authorization-time-interval). The CVSS 4.0 vector supplied with the CVE sets PR:N, which conflicts with the description; the vendor advisory should be checked for the actual precondition.

Affected

• Junos OS Evolved 0 to before 23.2R2-S7.7-EVO
• Junos OS Evolved 23.4 to before 23.4R2-S8.11-EVO
• Junos OS Evolved 24.2 to before 24.2R2-S5.6-EVO
• Junos OS Evolved 24.4 to before 24.4R2-S5-EVO
• Junos OS Evolved 25.2 to before 25.2R2-S2-EVO
• Junos OS Evolved 25.4 to before 25.4R1-S3-EVO
• Junos OS Evolved 26.2 to before 26.2R1-S2-EVO
• Junos OS Evolved 23.4X100
• Junos OS Evolved 25.2X100 to before 25.2X100-D35-EVO
• Junos OS Evolved 25.4X300 to before 25.4X300-D40-EVO

Source: CNA record. Vendor advisory JSA112250 has not been verified for this list.

Fixed in

• Junos OS Evolved 23.2R2-S7.7-EVO
• Junos OS Evolved 23.4R2-S8.11-EVO
• Junos OS Evolved 24.2R2-S5.6-EVO
• Junos OS Evolved 24.4R2-S5-EVO
• Junos OS Evolved 25.2R2-S2-EVO
• Junos OS Evolved 25.2X100-D35-EVO
• Junos OS Evolved 25.4R1-S3-EVO
• Junos OS Evolved 25.4R2-EVO
• Junos OS Evolved 25.4X300-D40-EVO
• Junos OS Evolved 26.2R1-S2-EVO
• Junos OS Evolved 26.2R2-EVO
• Junos OS Evolved 26.4R1-EVO
• All subsequent releases

For 23.2-EVO, 23.4-EVO and 24.2-EVO, Juniper has issued respins; previously published images have been rebuilt.

Workaround

Unknown. The vendor states there are no known workarounds.

Exploitation

Juniper SIRT is not aware of any malicious exploitation. CISA SSVC: exploitation none, automatable yes, technical impact total.

Our recommendation

• Check whether Junos OS Evolved is in use, for example on Juniper carrier or data-centre platforms.
• Check whether system tacplus-options authorization-time-interval is configured.
• Update affected devices to a fixed release from the advisory, using the respins for 23.x and 24.2 EVO where applicable.
• Until patched, review TACACS+ accounts and restrict them to least privilege, and limit access to device management interfaces.
• Monitor device logs for unexpected commands or privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper advisory JSA112250 supportportal.juniper.net
• OpenCVE CVE-2026-102031 app.opencve.io
• VulDB entry 420143 vuldb.com
• Juniper TACACS+ authentication documentation www.juniper.net
• Juniper authorization-time-interval configuration reference www.juniper.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:55.