Loading vulnerability…
CVE-2026-21902 is a critical incorrect permission assignment vulnerability in the On-Box Anomaly Detection framework of Juniper Networks Junos OS Evolved on PTX Series routers. The framework is intended to be reachable only by internal processes over an internal routing instance, but on affected releases it is exposed in a way that permits network access from outside that boundary. Because the service runs as root and is enabled by default, an unauthenticated network-based attacker can interact with the exposed framework and cause arbitrary code execution as root. Public technical analysis indicates the vulnerable component is a Python-based REST API used to define and schedule monitoring actions, and that attacker-controlled command data can be passed into shell execution paths, resulting in root-level remote code execution and complete device compromise.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a single Python script plus a README. The script (watchTowr-vs-JunosEvolved-CVE-2026-21902.py) is an unauthenticated network RCE artifact generator for Juniper Junos OS Evolved PTX devices vulnerable to CVE-2026-21902. It targets an HTTP service on the device (default port 8160) and performs a sequence of API calls: (1) cleanup via DELETE of prior objects (command/DAG/DAG-instance), (2) POST /config/command/<name> to create a command of type `RE-SHELL` with attacker-controlled `syntax` (the shell command), (3) POST /config/dag/<name> to create a DAG that runs that command, (4) POST /config/dag-instance/<name> to enable and schedule immediate execution (start=now, delay=0) for a specified platform string, and (5) POST /config/commit to apply changes. It then waits ~30 seconds for the scheduled job to run. Despite being described as a detection script, it actively executes an arbitrary command on the target to validate exploitability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
78 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical improper permission assignment vulnerability in Junos OS Evolved's On-Box Anomaly Detection framework that can allow unauthenticated attackers to gain root-level code execution and full control of affected Juniper PTX routers.
An incorrect permission assignment vulnerability affecting Juniper Junos OS Evolved on PTX Series devices (as described in the content).
An unauthenticated remote code execution vulnerability in Juniper Junos OS affecting Juniper PTX Series devices.
A critical privilege escalation / remote takeover vulnerability in Juniper Junos OS Evolved (PTX Series) caused by improper permission assignment in the On-Box Anomaly Detection framework, potentially enabling unauthenticated root-level code execution and full device control.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.