Act nowDisclosed

Advisory · CVE-2026-101954

J-Web authentication flaw in recent Junos releases can hand root configuration access to anyone who can reach it

An improper authentication vulnerability in the J-Web management interface and its NETCONF session handling in Junos OS and Junos OS Evolved lets an unauthenticated network attacker obtain root-level device configuration access via a reachable J-Web service when web management is enabled. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-101954
CWE-287
Action timing
Immediate
ELI5

Explain it like I’m five

If the web management page is reachable, an unauthenticated visitor can end up with root-level configuration access. The login screen is decoration.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01J-Web reachable

    The attacker reaches a device where the J-Web HTTP or HTTPS service is enabled.

  2. 02Authentication bypassed

    The improper authentication flaw in J-Web and its NETCONF handling lets the request through without credentials.

  3. 03Root configuration access

    The attacker gains root-level device configuration access and can take over the device.

What happened

Juniper disclosed CVE-2026-101954 in its October 2026 security release: an improper authentication vulnerability (CWE-287) in the J-Web management interface and its NETCONF session handling. The vendor record limits the affected releases to the 25.2, 25.4, and 26.2 lines before their October 2026 service thresholds. Web management must be enabled for the path to be reachable.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for J-Web logins or configuration changes without matching administrator activity, and NETCONF sessions from unexpected sources.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

This is the headline of the Juniper release. Disable or restrict J-Web today, patch on the emergency ring, and audit configuration history on any device where it was reachable.