Advisory · CVE-2026-102031
TACACS command injection in Junos OS Evolved can give a low-privilege user root
An OS command injection vulnerability in TACACS handling on Junos OS Evolved lets a low-privileged TACACS+-authenticated user execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
- Vendor
- Juniper Networks
- Product
- Junos OS Evolved
- Identifier / CWE
- CVE-2026-102031
CWE-78 - Action timing
- Immediate
Explain it like I’m five
A low-privilege login plus a background authorization refresh becomes a root shell, because refresh data is treated as shell commands.
- 01Low-privilege TACACS+ login
An attacker authenticates to the device with a low-privilege TACACS+ account.
- 02Authorization refresh fires
The periodic TACACS+ authorization-refresh runs with attacker-influenced data.
- 03Commands run as root
The injected commands execute with root privileges on the device.
What happened
Juniper disclosed CVE-2026-102031 in its October 2026 security release: an OS command injection vulnerability (CWE-78) in the TACACS path of Junos OS Evolved. When periodic TACACS+ authorization-refresh is enabled, a low-privileged TACACS+-authenticated user can get commands executed with root privileges.
Juniper’s JSA112250 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.
What to do
- Inventory every Junos OS Evolved deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Junos OS Evolved while remediation is underway, especially for internet-facing instances.
- Review application and server logs for unexpected root-level commands or configuration changes tied to TACACS+ authorization refresh cycles.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
AAA plumbing is a trust boundary. If TACACS+ refresh is enabled on Evolved devices, treat this as a root-compromise path and patch first, audit second.