CVE-2026-101986: Junos J-Web flaw lets attackers run CGI content without logging in

What it is

This is an improper authentication flaw (CWE-287) in J-Web, the web management interface of Junos OS and Junos OS Evolved. An attacker on the network, with no credentials, can send a crafted HTTP request that bypasses J-Web authentication and runs CGI content with elevated privileges.

It is rated CVSS 4.0 9.3 (CVSS 3.1 9.8). CISA’s SSVC data in the CVE record says exploitation is “none”, the attack is automatable, and the technical impact is total. Juniper SIRT says it is not aware of any malicious exploitation. The CVE is not in the CISA KEV catalog (catalog 2026.10.16), and EPSS is 0.6% (46th percentile, 2026-10-16). No public proof of concept is confirmed.

Low scores today don’t mean low risk. An automatable, unauthenticated bypass on a management interface is what attackers pick up quickly once patches are out. Juniper found it internally.

Juniper disclosed other J-Web bugs on the same day. See CVE-2026-101954 and CVE-2026-101956. Check that your target release covers all three.

Am I affected?

You are exposed if both are true:

1. You run a Junos OS or Junos OS Evolved version listed in the table above. Many trains are affected, from 23.2 to 26.2.
2. J-Web is reachable by an attacker. The CVE record does not state the configuration needed. J-Web is part of the web management service, so treat any device with J-Web enabled on a reachable interface as exposed.

Releases at or above the fixed versions are not affected. Juniper’s record also lists Junos OS 25.4R2, 26.2R2 and 26.4R1, and Junos OS Evolved 25.4R2-EVO, 26.2R2-EVO and 26.4R1-EVO, as fixed. The record says the 23.2, 23.4 and 24.2 builds (and their Evolved counterparts) were respun, so a build you downloaded earlier may need replacing.

For Junos OS Evolved 23.4X100 the record lists no fixed version. Read the advisory.

Check the configuration for the web management service and which interfaces can reach it. I could not open Juniper’s advisory, so confirm its exact configuration guidance before you rely on this.

What to do

1. Upgrade to a fixed release for your train, using the table above. Use the matching -EVO build on Junos OS Evolved. If you downloaded a 23.2, 23.4 or 24.2 image before 14 October, get the respun build.
2. Juniper lists no workaround. Until you can patch, reduce exposure: allow J-Web only from a trusted management network, or turn it off where nobody needs it. This is general hardening, not a Juniper-documented fix, and it may break GUI-based administration.
3. Review devices where J-Web was reachable from untrusted networks while on an affected version. No exploitation has been reported, but the bug gives elevated privileges. Compare the running configuration to a known-good copy and look for new users, changed login settings and unexpected services.
4. If you find unexpected changes, treat the device as compromised: rotate local credentials, keys and secrets stored in the configuration, and consider a rebuild.

Detection

No indicators of compromise or exploitation patterns have been published. Until that changes:

• Review J-Web access logs since 14 October 2026 (earlier if you have them) for requests from addresses outside your management network.
• Look for configuration changes you did not make, especially new accounts, changed authentication settings and new services.
• Watch for connection attempts to management interfaces from the internet.

Juniper’s advisory may describe more. Check it for log guidance.