Juniper Junos J-Web Authentication Bypass Grants Root Access to Networks

An authentication bypass flaw in Juniper Networks equipment allows attackers to take full control of devices without credentials. The vulnerability affects the J-Web management interface and its handling of NETCONF sessions, exposing organizations that enable web management on their network infrastructure.

What happened

The National Vulnerability Database records CVE-2026-101954 as a critical improper authentication weakness, identified by CWE-287. This flaw resides in the J-Web management interface and its NETCONF session handling components within Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated network attacker can exploit this issue to obtain root-level device configuration access.

Successful exploitation allows the attacker to take over the device entirely. This occurs via a reachable J-Web HTTP or HTTPS service when web management is enabled on the target system. The NVD assigns a CVSS score of 9.8 to this specific record, highlighting the severity of the unauthenticated access vector.

The second NVD record for the same CVE ID lists a slightly lower CVSS score of 9.3 but describes the identical improper authentication vulnerability. Both records confirm that the attack vector is network-based and requires no prior authentication. The weakness permits complete device takeover through the management interface.

Affected systems include Juniper Networks Junos OS versions before 25.2R2-S2, before 25.4R1-S3, and before 26.2R1-S2. Junos OS Evolved versions before 25.2R2-S2-EVO, before 25.4R1-S3-EVO, and before 26.2R1-S2-EVO are also vulnerable. Additionally, Junos OS Evolved version 23.4X100 is listed as affected by this critical flaw.

Why it matters

This vulnerability presents a severe risk to any organization using Juniper networking equipment with web management enabled. Because the attack is unauthenticated, external threat actors can exploit it from the internet if the J-Web service is reachable. Gaining root-level access allows attackers to modify configurations, install backdoors, or disrupt network operations.

The broad range of affected versions means many deployments may still be running vulnerable software. Organizations must verify their current Junos OS and Junos OS Evolved versions against the affected lists provided by the vendor. Failure to patch or mitigate could result in complete compromise of critical network infrastructure.

What to watch

• Monitor for unexpected configuration changes on Juniper devices.
• Watch for unauthorized NETCONF session initiations from unknown IPs.
• Check J-Web access logs for failed or successful unauthenticated attempts.
• Alert on any root-level access events that lack corresponding admin credentials.

Signals worth monitoring

Teams usually detect this type of activity by reviewing access logs for the J-Web interface. Look for HTTP or HTTPS requests to management endpoints that do not contain valid authentication tokens or session cookies. Security information and event management systems should flag any NETCONF connections that bypass standard identity verification processes.

Check whether root-level configuration changes occur without preceding login events from known administrator accounts. Unusual outbound traffic from network devices may indicate command and control communications following a takeover. Verify that all management interfaces are restricted to trusted networks and that unexpected service restarts are investigated promptly.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: Juniper Networks

• Audit all Juniper devices to confirm if J-Web management is enabled and reachable from untrusted networks.
• Restrict access to J-Web HTTP and HTTPS services using firewall rules to allow only trusted administrator IPs.
• Verify current Junos OS and Junos OS Evolved versions and compare them against the affected version lists.
• Monitor system logs for unauthorized configuration changes or unexpected NETCONF sessions until an update is applied.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-101954?

It is a critical improper authentication vulnerability in Juniper Networks Junos OS and Junos OS Evolved that allows unauthenticated attackers to take over devices via the J-Web interface.

Which Juniper products are affected?

Junos OS versions before 25.2R2-S2, 25.4R1-S3, and 26.2R1-S2, as well as Junos OS Evolved versions before 25.2R2-S2-EVO, 25.4R1-S3-EVO, 26.2R1-S2-EVO, and version 23.4X100.

Is there a patch available?

The source material lists affected versions prior to specific security releases, implying that updating to those versions mitigates the issue, but does not explicitly confirm a patch release status.