Juniper Patches Four Critical Junos Flaws, Including Root Takeover on MX Routers

Juniper Networks has published a batch of security bulletins for Junos OS and Junos OS Evolved, and four of the flaws carry a CVSS score of 9.8. Each one can be triggered by an attacker who never logs in. The good news is that Juniper says it is not aware of any malicious exploitation so far, and none of the four appear on CISA's Known Exploited Vulnerabilities catalog. The bad news is that there are no workarounds for any of them, so patching is the only real fix.

The one that should worry carriers and large networks most is CVE-2026-102182, covered in Juniper bulletin JSA112196. It is a stack-based buffer overflow in kmd, the key management daemon that handles IKE for IPsec on MX Series routers. An unauthenticated attacker on the network can send specially crafted certificate-based IKE packets and run code as root. Juniper states plainly that there are no known workarounds. Fixed releases include 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2, with older trains such as 21.2, 21.4, 22.2, 22.3 and 22.4 also receiving fixes.

The other three sit in J-Web, the browser-based management interface built into Junos. CVE-2026-101954, from bulletin JSA112187, abuses how J-Web handles NETCONF sessions and lets an unauthenticated attacker gain root-level configuration access and take over the device whenever web management is enabled and reachable. It affects Junos OS and Junos OS Evolved 25.2, 25.4 and 26.2, fixed in 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2 (plus the matching EVO builds).

CVE-2026-101956, detailed in JSA112188, lets a remote attacker run arbitrary Junos commands with root privileges through an exposed J-Web interface. It hits the same Junos OS 25.2, 25.4 and 26.2 trains, with the same fixed releases.

The widest reach belongs to CVE-2026-101986, also part of JSA112187. A crafted HTTP request can bypass J-Web authentication entirely and execute CGI content with elevated privileges. It affects Junos OS releases before 23.2R2-S7.7, 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3 and 26.2 before 26.2R1-S2. On Junos OS Evolved, the fixes include 23.4R2-S8.11-EVO and 24.2R2-S5.6-EVO, along with the EVO builds of the other releases.

So who needs to move first? Anyone running MX routers that terminate IPsec with certificate-based IKE should treat CVE-2026-102182 as urgent, since that service usually faces the internet by design. For the J-Web bugs, the risk depends on whether the web interface is turned on and who can reach it. Juniper lists no workarounds for any of these flaws, so the fixed releases are the answer. While you schedule maintenance windows, it is sensible general hygiene to make sure management interfaces like J-Web are never exposed to the internet and are reachable only from trusted hosts, but that only shrinks the exposure and does not replace the upgrade.

The full details, including every affected release, live in Juniper's bulletins on its support portal, which requires a Juniper account to read in full. The public CVE records linked above carry the same version data.