Junos J-Web: crafted HTTP request bypasses authentication and runs CGI content with elevated privileges

Impact

A single crafted HTTP request gets an unauthenticated attacker past J-Web authentication and into CGI execution at elevated privilege on the device. That is a foothold on the control plane of a datacenter switch or router: from there configuration, credentials cached on the box, and the forwarding behaviour of the fabric are all in reach. For a GPU cluster the practical consequence is an attacker able to tamper with the underlay that collective operations depend on, without ever holding a device credential.

Who can reach it

Anyone able to reach the J-Web HTTP/HTTPS service, usually from the management VLAN. Unauthenticated, no user interaction. Devices without web management enabled are not exposed.

What to do

Upgrade to a fixed Junos OS / Junos OS Evolved release per Juniper JSA112187, which is also the only authoritative list of fixed versions. The upgrade reboots the device, so plan a window per switch and drain nodes that sit behind a non-redundant path. Until then, disable J-Web or limit it to a management jump host with an interface filter - that mitigation takes effect without a reboot.

References

Related entries

• Junos rpd: flow-spec update selected for re-advertisement overflows a stack buffer, up to routing-engine compromiseCVE-2026-101990 · Juniper Junos OS / Junos OS Evolved rpd (BGP flow-spec route re-advertisement)Critical
• Junos OS Evolved: low-privileged TACACS+ user escalates to root via authorization refreshCVE-2026-102031 · Juniper Junos OS Evolved TACACS+ authorization-refresh handlingCritical
• Junos sdxd: heap overflow on the SDX/SRC connection yields root code execution on the deviceCVE-2026-102175 · Juniper Junos OS / Junos OS Evolved sdxd (service-deployment daemon)Critical
• Junos OS on MX: stack overflow in kmd gives unauthenticated root via IKE certificate packetsCVE-2026-102182 · Juniper Junos OS kmd on MX Series (IKE certificate-based packet handling)Critical
• Phala dcap-qvl - the Rust/npm/Python DCAP quote verification library used to verify Intel SGX and TDX attestationCVE-2026-22696 · Phala dcap-qvl - the Rust/npm/Python DCAP quote verification library used to verify Intel SGX and TDX attestation…Critical
• Junos OS on SRX: stack overflow in srxpfe gives unauthenticated root code execution via a crafted GRE packetCVE-2026-33792 · Juniper Junos OS on SRX Series (srxpfe, GRE tunnel packet handling)Critical