CVE-2026-101954 is a critical improper authentication flaw in Junos OS and Junos OS Evolved that lets an unauthenticated attacker get root-level configuration access through J-Web when web management is enabled.
What Is It
CVE-2026-101954 is an Improper Authentication vulnerability (CWE-287). It sits in the J-Web management interface and in how J-Web handles NETCONF sessions on Juniper Networks Junos OS and Junos OS Evolved. Juniper's description says an unauthenticated network attacker can get root-level device configuration access and take over the device. The attacker needs to reach the J-Web HTTP or HTTPS service, and web management must be enabled.
Juniper's SIRT published the record on 2026-10-14. NVD lists its status as "Received."
Why It Matters
Juniper scores the flaw 9.8 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 CRITICAL under CVSS 4.0. An attacker can exploit it over the network with low complexity, no privileges and no user interaction. A successful attack gives full control of the device's configuration, which means complete takeover of a network device.
The supplied data contains no CISA KEV entry for this CVE, so there is currently no KEV confirmation of active exploitation. Any device that exposes J-Web to untrusted networks should still be treated as a priority.
What's Vulnerable
Vulnerable devices run an affected release with J-Web web management enabled and reachable over HTTP or HTTPS.
Junos OS: - 25.2 versions before 25.2R2-S2 - 25.4 versions before 25.4R1-S3 - 26.2 versions before 26.2R1-S2
Junos OS Evolved: - 25.2 versions before 25.2R2-S2-EVO - 25.4 versions before 25.4R1-S3-EVO - 26.2 versions before 26.2R1-S2-EVO - 23.4X100 (affected; the record gives no fixed version) - 25.2X100 versions before 25.2X100-D35-EVO - 25.4X300 versions before 25.4X300-D40-EVO
The record marks all other versions as unaffected.
Patch Status
The version bounds in the record point to these fixed releases: - Junos OS: 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2 - Junos OS Evolved: 25.2R2-S2-EVO, 25.4R1-S3-EVO, 26.2R1-S2-EVO, 25.2X100-D35-EVO and 25.4X300-D40-EVO
The record lists no fixed version for Junos OS Evolved 23.4X100.
Without a KEV entry, there is no CISA-mandated required action or due date. Administrators should check Juniper advisory JSA112187 for the authoritative fixed releases and any vendor guidance, then upgrade affected devices. Since exploitation requires a reachable J-Web service, find every device where web management is enabled and exposed.