Junos OS and Junos OS Evolved (J-Web virtual-domain)
CVE-2026-101983: Junos J-Web flaw gives unauthenticated remote code execution
A stack-based buffer overflow in the Junos httpd process lets an unauthenticated network attacker run code or crash the device when a J-Web virtual-domain is configured (CVSS 9.3). Juniper knows of no exploitation, it is not on CISA's KEV list, and no public PoC is confirmed.
Published Updated Juniper Networks advisory JSA112187
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS 23.4 before 23.4R2-S8.13 | 23.4R2-S8.13 or later |
| Junos OS 24.2 before 24.2R2-S5.5 | 24.2R2-S5.5 or later |
| Junos OS 24.4 before 24.4R2-S5 | 24.4R2-S5 or later |
| Junos OS 25.2 before 25.2R2-S2 | 25.2R2-S2 or later |
| Junos OS 25.4 before 25.4R1-S3 | 25.4R1-S3 or later (25.4R2 also fixed) |
| Junos OS 26.2 before 26.2R1-S2 | 26.2R1-S2 or later (26.2R2 also fixed) |
| Junos OS Evolved 23.4 before 23.4R2-S8.11-EVO | 23.4R2-S8.11-EVO or later |
| Junos OS Evolved 24.2 before 24.2R2-S5.6-EVO | 24.2R2-S5.6-EVO or later |
| Junos OS Evolved 24.4 before 24.4R2-S5-EVO | 24.4R2-S5-EVO or later |
| Junos OS Evolved 25.2 before 25.2R2-S2-EVO | 25.2R2-S2-EVO or later |
| Junos OS Evolved 25.2X100 before 25.2X100-D35-EVO | 25.2X100-D35-EVO or later |
| Junos OS Evolved 25.4 before 25.4R1-S3-EVO | 25.4R1-S3-EVO or later (25.4R2-EVO also fixed) |
| Junos OS Evolved 25.4X300 before 25.4X300-D40-EVO | 25.4X300-D40-EVO or later |
| Junos OS Evolved 26.2 before 26.2R1-S2-EVO | 26.2R1-S2-EVO or later (26.2R2-EVO also fixed) |
| Junos OS Evolved 23.4X100 | No fixed version listed in the CVE record. Check the Juniper advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
CVE-2026-101983 is a stack-based buffer overflow (CWE-121) in the httpd process of Junos OS and Junos OS Evolved. An attacker who can reach the web service over the network, without logging in, can run code on the device or crash it. The CVSS 4.0 score is 9.3 (critical); the CVSS 3.1 score is 9.8.
The bug only matters when a J-Web virtual-domain is configured. It is not specific to SRX firewalls, but SRX devices run Junos OS and use J-Web, so they are in scope if they have that configuration.
Juniper found the bug internally and says its SIRT is not aware of any malicious exploitation. CISA’s ADP assessment rates exploitation as “none”, but marks the bug as automatable with total technical impact. The CVE is not in the CISA KEV catalog (catalog version 2026.10.16). EPSS gives a 0.5% chance of exploitation in the next 30 days (44th percentile, 2026-10-18). We found no public proof of concept.
Am I affected?
You’re affected if both are true:
- You run a Junos OS or Junos OS Evolved release older than the fixed releases in the table above.
- A J-Web virtual-domain is configured. The CVE record names this configuration:
system services web-management https virtual-domain <name> mtls
Devices without a virtual-domain are outside the condition Juniper describes. Check your configuration for that statement, and see Juniper’s advisory for how to confirm it on your platform.
Junos OS Evolved on the 23.4X100 train is listed as affected in the CVE record with no fixed version. Check JSA112187 for the current status. For 23.4 and 24.2 (both Junos OS and Evolved), Juniper has released respins and rebuilt earlier published builds, so make sure your build number matches the fixed one exactly.
What to do
- Upgrade to a fixed release for your branch (see the table above). Fixes are also in 25.4R2, 26.2R2 and 26.4R1, and their Evolved equivalents.
- There is no known workaround. Juniper lists none. Until you can upgrade, limit who can reach the web management service: allow it from trusted management networks only, and don’t expose it to the internet.
- If a device with a virtual-domain was reachable from untrusted networks while vulnerable, review it using the detection notes below. Rebuild it and rotate its credentials if you find signs of compromise.
Detection
No indicators of compromise have been published, and no exploitation has been reported. Because the flaw is in httpd, look for:
- Unexpected
httpdcrashes or restarts, which could be failed exploit attempts. - Web management (HTTPS) connections to the device from addresses that are not your management networks.
- New or changed configuration, user accounts or files you did not make.
Indicators of compromise
No indicators of compromise have been published for this CVE yet. We'll add them here if the vendor or a researcher releases any. Until then, use the behaviour in Detection.
Sources
Page changelog
- Full analysis published.
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.