Junos J-Web: unauthenticated attacker gains root-level configuration access to the device

CVSS 9.3CVE-2026-101954Firmware, BMC & network fabriccurated

Impact

An unauthenticated attacker who can reach the J-Web HTTP/HTTPS service gets root-level configuration access and effective ownership of the switch or router. On a GPU fabric that means the attacker can rewrite the EVPN-VXLAN or IP underlay that carries east-west training traffic, mirror tenant traffic to a port of their choosing, or black-hole a rail and stall every job pinned to it. Management interfaces on datacenter switches are frequently reachable from a broader operations network than operators assume, which is what makes an unauthenticated path to root configuration severe here.

Who can reach it

Any host that can open TCP to the J-Web HTTP or HTTPS listener - typically the management VLAN or an out-of-band network. No authentication and no user interaction required. Only affects devices with web management enabled.

What to do

Upgrade Junos OS / Junos OS Evolved to a release from the table in Juniper JSA112187; the advisory is the only source for fixed versions, so read it per platform rather than assuming. A Junos upgrade reboots the device, so every affected leaf and spine needs a maintenance window, and on a single-homed rail that means draining the GPU nodes behind it. The immediate mitigation that does not need a window is to disable web management, or to restrict J-Web to a jump host with a firewall filter on the management interface.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101954 https://supportportal.juniper.net/JSA112187

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.