Loading story…
Juniper Networks released security updates for Junos OS and Junos OS Evolved addressing critical flaws in the J-Web management interface. CVE-2026-101956 allows unauthenticated remote attackers to execute arbitrary Junos commands with root privileges on affected Junos OS devices. CVE-2026-101986 enables authentication bypass and elevated-privilege CGI execution on both operating systems. The vulnerabilities are independent, and exploitation requires J-Web to be enabled and reachable by the attacker. Juniper discovered the issues through internal testing and reported no known malicious exploitation; Beazley Security also reported no known public proof-of-concept exploits at publication.
The fixes form part of a broader update release that Italy’s national cybersecurity agency said addresses 23 critical and 119 high-severity vulnerabilities, including remote code execution, authentication bypass, denial of service, and privilege escalation. Canadian and Guyanese cybersecurity authorities also urged administrators to review affected Junos OS and Junos OS Evolved release branches and apply necessary updates. Organizations should prioritize devices with exposed J-Web interfaces, consult Juniper’s vulnerability-specific version matrices, and install applicable fixed releases or rebuilt software respins. Until patching is complete, administrators should disable J-Web or restrict access to trusted administrative networks; fixed versions listed in a separate, older OpenSSH-related Junos notice should not be treated as remediation thresholds for these J-Web flaws.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Juniper published security bulletins and updates for Junos OS and Junos OS Evolved, addressing CVE-2026-101956 and CVE-2026-101986; Italy's CSIRT reported 23 critical and 119 high-severity vulnerabilities across the updates. Juniper reported no known malicious exploitation of the two J-Web flaws, and no public proof-of-concept exploits were known at the time of the technical report.
In 2023, attackers chained J-Web vulnerabilities, including CVE-2023-36844, to achieve unauthenticated remote code execution on Juniper EX switches and SRX firewalls.
A Juniper support notice identifies an issue involving OpenSSH-7.5p1 affecting nearly all Junos OS platforms, excluding cRPD, cSRX and several SRX300-series devices. It identifies Junos OS 21.2R3-S5 and 21.3R3-S3, along with subsequent service releases, as fixed versions.
Juniper discovered CVE-2026-101956 and CVE-2026-101986 through internal security testing. The independent vulnerabilities allow unauthenticated root-level Junos command execution or elevated-privilege CGI execution when J-Web is enabled and reachable.
CISA added the previously exploited 2023 J-Web vulnerabilities to its Known Exploited Vulnerabilities catalog. The supplied content does not date the additions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourceacn.gov.it
Open sourcecirt.gy
Open sourcelabs.beazley.security
Open sourcesupportportal.juniper.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Juniper Networks released security updates for multiple vulnerabilities in **Junos OS** and **Junos OS Evolved** that could allow denial of service, bypass of security restrictions, or unauthorized access caused by incorrect initialization. The affected products should be assessed across network infrastructure where Junos software is deployed. Notable issues include **CVE-2026-57026**, a network-reachable, unauthenticated denial-of-service vulnerability rated **CVSS 7.5**, and **CVE-2026-57028**, a network-reachable, unauthenticated access-control vulnerability rated **CVSS 7.3**. Organizations should test and deploy Juniper’s available fixes promptly, prioritizing internet-facing and otherwise untrusted-network-reachable devices.
Sep 27, 2026
Juniper Networks has released a comprehensive set of security patches addressing nearly 220 vulnerabilities across its Junos OS, Junos Space, and Security Director products, with a particular focus on nine critical flaws in Junos Space. Among the most severe issues is CVE-2025-59978, a cross-site scripting (XSS) vulnerability in Junos Space that allows attackers to inject malicious scripts into web pages, which are then executed with administrative privileges when viewed by other users. This could enable attackers to gain full control of the system, manipulate configurations, or exfiltrate sensitive data. Another critical flaw, CVE-2025-59974, affects Junos Space Security Director and also involves persistent XSS, enabling attackers to store and execute malicious scripts in the context of other users’ browsers. CVE-2025-59975 describes an uncontrolled resource consumption vulnerability in the HTTP daemon of Junos Space, where an attacker can flood the device with API calls, exhausting system resources and causing a denial of service that blocks both WebUI and CLI management access until a manual reboot is performed. CVE-2025-59968 highlights a missing authorization vulnerability in Junos Space Security Director, allowing unauthenticated attackers to read or modify metadata via the web interface, potentially resulting in managed SRX Series devices permitting unauthorized network traffic and bypassing security policies. Additionally, CVE-2025-11198 in Security Director Policy Enforcer exposes an unrestricted API that could let unauthenticated attackers upload and deploy malicious vSRX images to VMware NSX servers, provided a trusted user initiates deployment, thereby compromising the integrity of virtualized network security appliances. The vulnerabilities affect various versions of Junos Space and Security Director, with patches provided in Junos Space 24.1R4 Patch V1 and other specified updates. Juniper has stated that, as of the time of disclosure, there is no evidence of these vulnerabilities being exploited in the wild. The company strongly recommends that all users apply the latest patches to mitigate the risk of exploitation. The technical nature of these flaws, particularly those affecting administrative and management interfaces, underscores the potential for significant impact, including unauthorized access, denial of service, and compromise of network security controls. The breadth of the vulnerabilities, ranging from XSS to missing authorization and resource exhaustion, highlights the importance of comprehensive patch management and regular security reviews for organizations relying on Juniper’s network management solutions. The patches address not only the critical vulnerabilities but also a wide array of other issues, reflecting Juniper’s ongoing efforts to enhance the security posture of its products. Organizations are urged to review the affected product versions and ensure timely deployment of the recommended updates. Failure to patch could leave critical network infrastructure exposed to remote exploitation, data breaches, and operational disruptions. The coordinated disclosure and patch release demonstrate the importance of vendor transparency and proactive security practices in the face of evolving threats. Security teams should also consider reviewing access controls and monitoring for unusual activity on management interfaces as an additional precaution. The vulnerabilities serve as a reminder of the risks inherent in complex network management platforms and the necessity of maintaining up-to-date defenses.
Jun 29, 2026
Juniper Networks disclosed multiple high-severity vulnerabilities in **Junos OS** and **SRX/MX** platforms, including remotely exploitable denial-of-service flaws and local privilege-escalation issues. The most exposed bugs include **`CVE-2026-33790`**, which lets an unauthenticated attacker crash the `srxpfe` packet forwarding engine on **SRX Series** firewalls by sending a malformed **ICMPv6** packet to devices with **NAT64** enabled, and **`CVE-2026-33778`**, which allows a malformed initial **ISAKMP** packet to crash the `kmd` or `iked` daemons on **SRX** and **MX** systems providing IPsec VPN services. Juniper said repeated exploitation can sustain outages by forcing affected processes into crash loops, and that fixes were released through security bulletins including **`JSA107874`** and **`JSA107868`**. Juniper also fixed **`CVE-2026-33785`**, a missing authorization flaw in **MX Series** routers that allows any locally authenticated user to run privileged `request csds` commands and potentially compromise managed infrastructure in **JDM/CSDS** deployments, and **`CVE-2026-21916`**, a symlink-handling bug in the Junos CLI that can let a low-privileged user gain **root** when another user performs a configuration commit. Affected versions span several supported Junos release trains, with fixes issued on April 8, 2026; some older branches, including certain end-of-life releases, do not have patches. Detection guidance from Juniper and Tenable relies largely on version auditing, configuration review for exposed features such as NAT64 and IPsec, and monitoring for daemon crashes, suspicious `file link` activity, unexpected root access, and abuse of privileged management commands.
Jun 29, 2026