{"id":"CVE-2026-101954","published":"2026-10-14T18:17:11.277","lastModified":"2026-10-16T15:16:59.280","description":"An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://supportportal.juniper.net/JSA112187","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An unauthenticated attacker can gain root-level access to Juniper devices through the J-Web management interface, allowing complete device takeover without any authentication credentials. This critical vulnerability affects both Junos OS and Junos OS Evolved platforms.","exploitability":"The exploit is highly practical with minimal preconditions - an attacker only needs network access to a device with web management enabled, making it extremely easy to leverage for remote compromise.","blast_radius":"This vulnerability could impact thousands of network devices across enterprise and critical infrastructure environments, potentially allowing attackers to gain complete control over network infrastructure with no authentication required.","remediation":"Disable the J-Web management interface immediately or restrict access to it via firewall rules until a patch is available, as no fixed version has been published in the description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","network","juniper"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:52:14.548Z"}}