{"id":"CVE-2026-101956","published":"2026-10-14T17:17:48.353","lastModified":"2026-10-15T16:24:19.073","description":"An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://supportportal.juniper.net/JSA112188","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An unauthenticated remote attacker can execute arbitrary Junos commands with root privileges through the exposed J-Web web interface due to improper authentication implementation.","exploitability":"Exploitation is straightforward with no prerequisites as the vulnerability allows remote execution without authentication, requiring only access to the J-Web interface.","blast_radius":"The flaw could impact a large number of Juniper routers and switches running vulnerable Junos OS versions, potentially allowing attackers to gain full system control across multiple network devices.","remediation":"Disable the J-Web web management interface immediately or upgrade to Junos OS version 22.4R3 or later.","detection":"Monitor for unauthorized access attempts to the J-Web interface (typically port 80 or 443) and look for suspicious command execution patterns in system logs, particularly those showing root-level command invocations from unauthenticated sessions.","tags":["web","auth-bypass","rce","juniper"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:50:16.130Z"}}