Juniper Networks has disclosed a critical OS command injection flaw in the TACACS+ component of Junos OS Evolved that lets a low-privileged TACACS+-authenticated user run commands as root when periodic TACACS+ authorization-refresh is enabled.
What Is It
CVE-2026-102031 is an OS command injection vulnerability (CWE-78) in the TACACS implementation of Juniper Networks Junos OS Evolved. Juniper's description says a low-privileged user who has authenticated through TACACS+ can execute commands with root privileges. Exploitation depends on one setting: periodic TACACS+ authorization-refresh must be enabled.
Juniper's SIRT published the record to NVD on 2026-10-14. Its NVD status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
Juniper rates the flaw CVSS 3.1 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Under CVSS 4.0 it scores 9.3 (CRITICAL) and is marked Automatable: Yes. Running commands as root gives full control of the affected network device.
The vector says no privileges are required (PR:N), but the written description requires a TACACS+-authenticated, low-privileged user. Defenders should go by the description. Any account that authenticates through TACACS+ could become a route to root on the device.
The CISA KEV catalog has no entry for this CVE. Active exploitation is not confirmed by KEV at this time, and the supplied data includes no CISA required action or due date.
What's Vulnerable
Juniper Networks Junos OS Evolved, in these affected ranges:
- All versions before 23.2R2-S7.7-EVO
- 23.4 before 23.4R2-S8.11-EVO
- 24.2 before 24.2R2-S5.6-EVO
- 24.4 before 24.4R2-S5-EVO
- 25.2 before 25.2R2-S2-EVO
- 25.4 before 25.4R1-S3-EVO
- 26.2 before 26.2R1-S2-EVO
- 23.4X100 (listed as affected, with no upper bound given)
- 25.2X100 before 25.2X100-D35-EVO
- 25.4X300 before 25.4X300-D40-EVO
Exposure requires TACACS+ with periodic authorization-refresh enabled. The record lists Junos OS Evolved only. It does not mention standard Junos OS.
Patch Status
For each release train, the affected range ends at the version shown above, which points to those builds as the fixed releases. The 23.4X100 train has no bounded fix version in the record. Juniper's advisory JSA112250 is the authoritative source for fixed releases and any workarounds.
Administrators should:
- Confirm whether periodic TACACS+ authorization-refresh is enabled on Junos OS Evolved devices.
- Upgrade to a release at or above the bound for their train.
- Review which TACACS+ accounts can authenticate to affected devices.
Sources
- Juniper Networks Security Advisory JSA112250
- NVD, CVE-2026-102031
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)