Junos OS J-Web
CVE-2026-101956: Junos J-Web bug gives unauthenticated attackers root commands
An improper authentication flaw in the J-Web interface of Junos OS lets an unauthenticated network attacker run Junos commands as root (CVSS 4.0 9.3). Juniper's record has no workaround; PatchTonight found no exploitation report and it is not in CISA KEV.
Published Updated
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS 25.2 before 25.2R2-S2 | 25.2R2-S2 or later |
| Junos OS 25.4 before 25.4R1-S3 | 25.4R1-S3, 25.4R2 or later |
| Junos OS 26.2 before 26.2R1-S2 | 26.2R1-S2, 26.2R2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
J-Web is the browser-based management interface of Junos OS. On affected releases, an improper authentication flaw (CWE-287) lets an unauthenticated attacker over the network run Junos commands as root through J-Web. The CVSS 4.0 score is 9.3 (critical), with high impact on confidentiality, integrity and availability.
Juniper’s CVE record says there are no known workarounds. We found no report of exploitation, no public proof of concept and no CISA KEV listing (catalog 2026.10.16). EPSS was 0.7% on 2026-10-16. That can change fast for a bug that needs no login, so treat this as a patch-soon item.
Am I affected?
You’re affected if you run Junos OS on one of these branches and J-Web is enabled and reachable:
- 25.2 before 25.2R2-S2
- 25.4 before 25.4R1-S3
- 26.2 before 26.2R1-S2
The CVE record’s title says the issue applies “when J-Web is enabled”. Devices with J-Web turned off should not be exposed through this path. Check your J-Web configuration and which interfaces and networks can reach it. The CVE record lists only “Junos OS”, so confirm the affected platforms (for example SRX) in the advisory.
What to do
- Upgrade to 25.2R2-S2, 25.4R1-S3 (or 25.4R2), or 26.2R1-S2 (or 26.2R2), or any later release. 26.4R1 is also listed as fixed.
- There is no vendor workaround. Until you upgrade, reduce exposure: don’t let J-Web be reachable from the internet or untrusted networks, and limit it to a management network. Check Juniper’s documentation for the exact configuration, as we could not confirm commands from the advisory.
- If J-Web was reachable from untrusted networks, review the device for unexpected configuration changes, new users, and unknown commands in logs. Rotate credentials stored on the device if you find anything.
Detection
No indicators of compromise or exploitation signatures have been published. Review J-Web access and system logs for requests from unknown addresses, commands run that no administrator issued, and unexpected configuration commits or new accounts. Check Juniper’s advisory for any detection guidance.
Indicators of compromise
Checked the CVE record and a web search for published indicators or exploitation reports; found none. Not listed in CISA KEV as of catalog 2026.10.16.
No indicators of compromise have been published for this CVE yet. We'll add them here if the vendor or a researcher releases any. Until then, use the behaviour in Detection.
Sources
Page changelog
- Full analysis published.
KEV status, EPSS score and vendor data refreshed automatically, last on 17 Oct 2026.