{"id":"CVE-2026-102031","published":"2026-10-14T17:17:56.617","lastModified":"2026-10-16T15:17:00.720","description":"An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://supportportal.juniper.net/JSA112250","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A low-privileged TACACS+ user can execute arbitrary OS commands with root privileges through a command injection flaw in Juniper's TACACS implementation when periodic authorization refresh is enabled. This allows attackers to gain full system control without needing elevated credentials.","exploitability":"Exploitation is relatively straightforward for authenticated TACACS+ users, requiring only the ability to trigger periodic authorization refresh with crafted input that gets executed as root commands.","blast_radius":"The vulnerability affects all Juniper devices running Junos OS Evolved with periodic TACACS+ authorization refresh enabled, potentially allowing attackers to compromise entire network infrastructures with a single authenticated session.","remediation":"Disable periodic TACACS+ authorization refresh until a patch is available, or upgrade to Junos OS Evolved 23.4R1 or later if available.","detection":"Monitor for unusual command execution patterns in system logs during TACACS+ authorization refresh intervals, particularly commands that appear to execute with root privileges without explicit user context.","tags":["rce","tacacs","network","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:50:52.090Z"}}