Critical Authentication Bypass in Juniper Junos OS J-Web (CVE-2026-101956, CVE-2026-101986)

Executive Summary

On October 14th, 2026, Juniper Networks published its October security bulletins for Junos OS and Junos OS Evolved, resolving two critical authentication vulnerabilities in the J-Web management interface. Tracked as CVE-2026-101956, the most severe flaw lets an unauthenticated, remote attacker execute arbitrary Junos commands with root privileges on Junos OS devices where J-Web is reachable. The second flaw, tracked as CVE-2026-101986, lets an unauthenticated attacker bypass J-Web authentication with a crafted HTTP request and execute CGI content with elevated privileges on both Junos OS and Junos OS Evolved. The two issues share a component, a vulnerability class, and a precondition, but they are separate flaws rather than an exploit chain.

Junos OS and Junos OS Evolved run Juniper routers, switches, and SRX firewalls that sit at the core and edge of enterprise and service provider networks. J-Web is the browser-based management interface for these devices, and compromise through it gives an attacker control of the device itself. Previous J-Web flaws have been weaponized quickly: in 2023, attackers chained a set of J-Web vulnerabilities, including CVE-2023-36844, to achieve unauthenticated remote code execution on Juniper EX switches and SRX firewalls, and CISA added them to its Known Exploited Vulnerabilities catalog shortly thereafter. Juniper has released fixes for both vulnerabilities.

Juniper reports that it found these issues during internal security testing and is not aware of malicious exploitation, and no public proof-of-concept exploits are known to exist at the time of writing. Beazley Security recommends affected organizations apply available fixes as soon as possible.

Affected Systems or Products

Junos OS 26.4R1 and Junos OS Evolved 26.4R1-EVO also include the fixes. Both vulnerabilities are only reachable on devices where the J-Web management interface is enabled.

Mitigations / Workarounds

Upgrading to a fixed release is the recommended remediation. A single upgrade to a fixed release on the 25.2, 25.4, or 26.2 branches addresses both vulnerabilities. Devices on older Junos OS branches and on Junos OS Evolved are affected by CVE-2026-101986 only. For the 23.2, 23.4, and 24.2 branches, Juniper has published rebuilt software respins that should be installed.

If organizations are unable to apply fixes immediately, the following steps may help to temporarily reduce risk:

1. 1.

   Disable the J-Web management interface on affected devices until updates can be applied.

2. 2.

   Where J-Web must remain enabled, limit access to it to trusted administrative hosts and networks, and never expose it to the internet.

Patches

Juniper has released fixed versions of Junos OS and Junos OS Evolved for both vulnerabilities. Fixed releases are available through the Juniper support portal, and additional information can be found in the official Juniper security bulletins.

Technical Details

CVE-2026-101956 is an improper authentication flaw (CWE-287) in J-Web, the web management component of Junos OS and Junos OS Evolved. Juniper titles the issue "Unauthorized root command execution when J-Web is enabled." An attacker with network access to an exposed J-Web interface can execute arbitrary Junos commands with root privileges. The attack requires no credentials and no user interaction.

The only stated precondition is that J-Web is enabled and reachable by the attacker. According to the CVE record, the flaw affects Junos OS from 25.2 before 25.2R2-S2, from 25.4 before 25.4R1-S3, and from 26.2 before 26.2R1-S2. The CVE record does not list Junos OS Evolved as affected.

CVE-2026-101986 is an improper authentication flaw (CWE-287) in J-Web on both Junos OS and Junos OS Evolved. Juniper titles the issue "J-Web permits pre-authentication CGI execution." An unauthenticated attacker with network access to J-Web sends a crafted HTTP request that bypasses authentication and executes CGI content with elevated privileges. The attack requires no credentials and no user interaction.

Devices are exposed only when J-Web is enabled through the system services web-management configuration. Unlike CVE-2026-101956, this flaw reaches across every supported branch of both operating systems, starting with all releases before 23.2R2-S7.7. Junos OS Evolved 23.4X100 has no fixed release listed.

Juniper has not published technical details beyond the vulnerability description, and no public PoC or in-the-wild exploitation is known at the time of writing.

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• 

  https://nvd.nist.gov/vuln/detail/CVE-2026-101956

• 

  https://nvd.nist.gov/vuln/detail/CVE-2026-101986

• 

  https://supportportal.juniper.net/s/article/2026-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Multiple-vulnerabilities-resolved

• 

  https://euvd.enisa.europa.eu/enisa/EUVD-2026-101440

• 

  https://euvd.enisa.europa.eu/enisa/EUVD-2026-101450

• 

  https://securityonline.info/juniper-patches-critical-junos-os-vulnerabilities/