Junos OS Evolved: low-privileged TACACS+ user escalates to root via authorization refresh

Impact

On devices configured for periodic TACACS+ authorization refresh, a user who authenticates with the lowest read-only privilege can inject OS commands that run as root. Network teams in GPU datacenters routinely hand out read-only switch logins to platform engineers, NOC staff and monitoring integrations; this turns any one of those accounts into full control of a fabric switch, including the ability to change forwarding and ACLs that separate tenants. Because the escalation happens through the normal authorization path, it leaves little trace beyond an ordinary login. Juniper scored it 9.3. Only devices with periodic authorization refresh enabled are affected.

Who can reach it

Network: any user holding valid TACACS+ credentials on the device, including an unprivileged read-only account. Authentication required.

What to do

Upgrade to the fixed Junos OS Evolved release in JSA112250 (reboot required, so one maintenance window per device). If the upgrade cannot be scheduled immediately, disabling periodic TACACS+ authorization refresh removes the condition, and auditing who holds TACACS+ accounts on fabric devices limits the pool of attackers. The record does not name fixed versions.

References

Related entries

• Junos sdxd: heap overflow on the SDX/SRC connection yields root code execution on the deviceCVE-2026-102175 · Juniper Junos OS / Junos OS Evolved sdxd (service-deployment daemon)Critical
• Junos OS on MX: stack overflow in kmd gives unauthenticated root via IKE certificate packetsCVE-2026-102182 · Juniper Junos OS kmd on MX Series (IKE certificate-based packet handling)Critical
• Phala dcap-qvl - the Rust/npm/Python DCAP quote verification library used to verify Intel SGX and TDX attestationCVE-2026-22696 · Phala dcap-qvl - the Rust/npm/Python DCAP quote verification library used to verify Intel SGX and TDX attestation…Critical
• Junos OS on SRX: stack overflow in srxpfe gives unauthenticated root code execution via a crafted GRE packetCVE-2026-33792 · Juniper Junos OS on SRX Series (srxpfe, GRE tunnel packet handling)Critical
• Voltronic Power SNMP Web Pro: unauthenticated firmware upload yields root on the UPS management cardCVE-2026-44402 · Voltronic Power SNMP Web Pro 1.1 (upload.cgi firmware update endpoint)Critical
• fakefish: KubeVirt backend ignores Redfish credentials, exposing VM power and virtual mediaCVE-2026-71566 · fakefish (Redfish BMC shim, KubeVirt backend)Critical