CVE-2026-101954: Junos J-Web flaw gives unauthenticated attackers root access

What it is

This is an improper authentication flaw (CWE-287) in the J-Web management interface and in how it handles NETCONF sessions. An attacker on the network who can reach J-Web over HTTP or HTTPS needs no credentials. They can get root-level configuration access and take over the device.

It is rated CVSS 4.0 9.3 (CVSS 3.1 9.8). CISA’s SSVC data in the record says exploitation is “none”, the attack is automatable, and the technical impact is total. Juniper SIRT says it is not aware of any malicious exploitation, the CVE is not in the CISA KEV catalog (catalog 2026.10.16), and EPSS is low (0.5%). No public proof of concept is confirmed.

Do not read the low exploitation scores as low risk. An unauthenticated, automatable root takeover on a management interface is the kind of bug attackers pick up quickly once a patch is out.

Am I affected?

You are exposed if both are true:

1. You run a Junos OS or Junos OS Evolved version listed in the table above.
2. J-Web (web management) is enabled and reachable over HTTP or HTTPS. The record says the attack needs a reachable J-Web service when web management is enabled.

OpenCVE ties the exposure to the system services web-management configuration hierarchy. Check that hierarchy for http or https services, and check which interfaces and addresses can reach them.

Only the branches in the table are listed as affected: Junos OS 25.2, 25.4 and 26.2, and Junos OS Evolved 25.2, 25.4, 26.2, 25.2X100, 25.4X300 and 23.4X100. For Evolved 23.4X100 the record lists no fixed version, so read the Juniper advisory.

Juniper’s fixed-release list also names older trains (Junos OS 23.2, 23.4, 24.2 and 24.4, with matching Evolved builds). OpenCVE says Juniper rebuilt some of them. The affected-version data does not list those trains, so confirm in the advisory whether they matter to you.

The editor’s note mentions SRX firewalls. The sources I could open name Junos OS and Junos OS Evolved generally and do not name specific hardware.

What to do

1. Upgrade to a fixed release for your branch: Junos OS 25.2R2-S2, 25.4R1-S3 or 26.2R1-S2 or later. For Junos OS Evolved use the matching -EVO build, or 25.2X100-D35-EVO or 25.4X300-D40-EVO on those trains. Juniper’s fixed list also includes 25.4R2, 26.2R2 and 26.4R1.
2. Juniper lists no workaround. Until you can patch, reduce exposure. OpenCVE suggests restricting inbound access to J-Web ports 80 and 443 with a firewall or ACLs. Turning off J-Web where nobody needs it, and allowing management access only from a trusted management network, goes the same way. This is OpenCVE’s advice, not Juniper’s.
3. Review the device if J-Web was reachable from untrusted networks while it ran an affected version. No exploitation has been reported, but the bug gives root-level configuration access. Compare the running configuration to a known-good copy, and look for new users, changed login settings and unexpected NETCONF or management access.
4. If you find unexpected changes, treat the device as compromised: rotate local credentials, keys and any secrets stored in the configuration, and consider a rebuild.

Detection

No indicators of compromise or exploitation patterns have been published. Until that changes:

• Review J-Web and NETCONF access logs since October 14, 2026 (earlier if you have them) for sessions from addresses outside your management network.
• Look for configuration changes you did not make, especially new accounts, changed authentication or management settings, and new services.
• Watch for connection attempts to ports 80 and 443 on management interfaces from the internet.

Juniper’s advisory may describe more. Check it for log guidance.