Loading story…
Juniper disclosed a critical remote code execution vulnerability in Junos OS Evolved running on PTX Series routers that can allow an unauthenticated, network-based attacker to execute code as root and potentially take full control of affected devices (CVE-2026-21902). The flaw stems from incorrect permission assignment in the On-Box Anomaly Detection framework, which is intended to be reachable only by internal processes over an internal routing instance but is exposed via an externally reachable port; the vulnerable service runs as root and is enabled by default.
Affected versions are 25.4 releases prior to 25.4R1-S1-EVO and 25.4R2-EVO on PTX Series; standard (non-Evolved) Junos OS and Junos OS Evolved versions before 25.4R1-EVO are not impacted. Juniper released fixes in 25.4R1-S1-EVO, 25.4R2-EVO, and 26.2R1-EVO, and at the time of advisory publication stated it was not aware of active exploitation; guidance includes prioritizing patching and, where immediate updates are not possible, restricting access to the exposed endpoints using firewall filters/ACLs. The Canadian Centre for Cyber Security echoed the vendor advisory and urged administrators to apply the updates.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
In its disclosure and related reporting, Juniper said it was not aware of active exploitation of CVE-2026-21902 at the time the bulletin was issued. The company also recommended interim mitigations such as ACLs, firewall filters, or disabling the affected service.
On 2026-02-25, the Canadian Centre for Cyber Security published advisory AV26-172 highlighting Juniper's disclosure of CVE-2026-21902. It urged administrators to review Juniper's guidance and apply the necessary updates.
On 2026-02-25, Juniper disclosed CVE-2026-21902 in advisory JSA107128, describing a critical unauthenticated remote code execution flaw that can lead to root-level compromise on exposed PTX Series devices running Junos OS Evolved 25.4. Juniper released fixed versions including 25.4R1-S1-EVO and 25.4R2-EVO, and multiple reports also cite 26.2R1-EVO as a patched release.
Juniper SIRT said CVE-2026-21902 was identified through internal product security testing. The flaw affects the On-Box Anomaly Detection framework in Junos OS Evolved on PTX Series routers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
11 references tracked. Mallory keeps watching after this page renders.
upguard.com
Open sourcethecyberthrone.in
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcecyber.gc.ca
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecsa.gov.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Juniper disclosed **CVE-2026-21902**, a critical **remote code execution** vulnerability in *Junos OS Evolved* affecting **PTX Series** routers. The issue is an **incorrect permission assignment for a critical resource** in the **On-Box Anomaly Detection** framework; if the service is reachable over the network, an **unauthenticated attacker** can execute code as **root**, enabling full device takeover. The service is described as running as root and being enabled by default, increasing impact where exposure exists. watchTowr researchers reported the flaw and published technical analysis indicating the affected framework is intended for internal process communication and “should only be reachable” via internal interfaces, but may become accessible depending on configuration. Juniper advised customers to **restrict/filter access** (e.g., via **firewall rules or ACLs**) and indicated a patch would follow; impacted releases called out include **25.4R1-S1-EVO** and **25.4R2-EVO**, while **non-Evolved Junos OS** releases prior to `25.4R1-EVO` were reported as not impacted. Juniper stated it had **no evidence of active exploitation** at the time of disclosure.
Jun 29, 2026
Juniper disclosed two denial-of-service vulnerabilities in **Junos OS Evolved** affecting **PTX Series** routers, with one issue also impacting the **QFX5000 Series**. The first flaw, tracked as **`CVE-2025-59969`**, allows an attacker to send crafted multicast packets that cause the `evo-aftmand` and `evo-pfemand` processes to crash and restart, disrupting forwarding-related functions on affected devices. A second vulnerability, **`CVE-2026-33783`**, affects PTX systems where **SR-TE tunnels provisioned via PCEP** are present; under those conditions, specific **gRPC** queries can trigger a crash in the `evo-aftman` process. Together, the advisories describe service instability risks in carrier-grade routing platforms, with crashes tied to malformed network traffic and management-plane queries rather than code execution.
Apr 9, 2026
Juniper Networks disclosed multiple high-severity vulnerabilities in **Junos OS** and **SRX/MX** platforms, including remotely exploitable denial-of-service flaws and local privilege-escalation issues. The most exposed bugs include **`CVE-2026-33790`**, which lets an unauthenticated attacker crash the `srxpfe` packet forwarding engine on **SRX Series** firewalls by sending a malformed **ICMPv6** packet to devices with **NAT64** enabled, and **`CVE-2026-33778`**, which allows a malformed initial **ISAKMP** packet to crash the `kmd` or `iked` daemons on **SRX** and **MX** systems providing IPsec VPN services. Juniper said repeated exploitation can sustain outages by forcing affected processes into crash loops, and that fixes were released through security bulletins including **`JSA107874`** and **`JSA107868`**. Juniper also fixed **`CVE-2026-33785`**, a missing authorization flaw in **MX Series** routers that allows any locally authenticated user to run privileged `request csds` commands and potentially compromise managed infrastructure in **JDM/CSDS** deployments, and **`CVE-2026-21916`**, a symlink-handling bug in the Junos CLI that can let a low-privileged user gain **root** when another user performs a configuration commit. Affected versions span several supported Junos release trains, with fixes issued on April 8, 2026; some older branches, including certain end-of-life releases, do not have patches. Detection guidance from Juniper and Tenable relies largely on version auditing, configuration review for exposed features such as NAT64 and IPsec, and monitoring for daemon crashes, suspicious `file link` activity, unexpected root access, and abuse of privileged management commands.
Jun 29, 2026