Junos OS J-Web: unauthenticated attacker runs arbitrary Junos commands as root

CVSS 9.3CVE-2026-101956Firmware, BMC & network fabriccurated

Impact

An unauthenticated attacker who can reach the J-Web web management interface can execute arbitrary Junos commands with root privileges, which is full administrative control of the device. On a Junos box carrying datacenter traffic that means the attacker can rewrite forwarding and filter policy, mirror traffic to a destination of their choosing, or black-hole a fabric segment - so a single exposed management interface becomes both an interception point and an outage. Device credentials, RADIUS/TACACS secrets and configuration stored on the box should be considered compromised. Unlike a feature-specific flaw this one sits in the management plane that is present on any Junos device where J-Web is enabled.

Who can reach it

Any attacker with network reach to the device's J-Web HTTP/HTTPS interface - in a well-segmented deployment that is the management VLAN, but J-Web is frequently reachable more broadly than intended. No credentials and no user interaction are required.

What to do

Apply the fixed Junos releases named in Juniper advisory JSA112188; the advisory is the authoritative source for the version matrix and this record does not restate it. Installing a Junos software fix requires a maintenance window with a device reboot, so plan around redundancy in the affected path. Until the upgrade lands, the practical mitigation is to disable J-Web entirely (manage via CLI/NETCONF) or restrict access to it to a trusted management network with firewall filters on the loopback and management interfaces.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101956 https://supportportal.juniper.net/JSA112188

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.