Juniper's October Junos bulletin lists 15 CVSS 9.8 flaws, four of them unauthenticated J-Web bugs and one a root overflow in MX IKE. None is known exploited.
Juniper's October 2026 Junos bulletin carries 15 vulnerabilities that Juniper itself scores CVSS 3.1 9.8. Four are unauthenticated flaws in the J-Web management interface, and a fifth is a root code-execution bug in the IKE service on MX Series routers. Juniper's CVE records say its security team (Juniper SIRT) is not aware of malicious exploitation, and none of the 15 is in CISA's Known Exploited Vulnerabilities catalog. CISA's SSVC assessment marks seven of them, including three of the four J-Web bugs and the MX IKE flaw, as automatable with total technical impact, so the gap between disclosure and exploitation may be short.
What happened
On 2026-10-14 Juniper SIRT, acting as CNA, published CVE records for the October Junos OS and Junos OS Evolved bulletin. Fifteen carry a CVSS 3.1 base score of 9.8 (CVSS 4.0: 9.3, or 9.2 for CVE-2026-33789). NVD lists them as "Awaiting Analysis", so the scores are Juniper's. Juniper's support portal did not render for us; everything below comes from Juniper's CVE records (as published through CVE.org), which carry its descriptions, configurations, workarounds and fixed releases.
Six of the 15 give unauthenticated code or command execution without a peer or server relationship (some need a feature configured):
| CVE | Component | Flaw | Advisory |
|---|---|---|---|
| CVE-2026-101954 | J-Web / NETCONF sessions | Improper authentication; root-level configuration access and device takeover | JSA112187 |
| CVE-2026-101956 | J-Web (Junos OS) | Improper authentication; arbitrary Junos commands as root | JSA112188 |
| CVE-2026-101983 | httpd, J-Web virtual domain | Stack overflow; remote code execution | JSA112187 |
| CVE-2026-101986 | J-Web | Improper authentication; CGI content run with elevated privileges | JSA112187 |
| CVE-2026-102182 | kmd, MX Series | Stack overflow; code execution as root via IKE certificate packets | JSA112196 |
| CVE-2026-33792 | srxpfe, SRX Series | Stack overflow; code execution as root via a packet on a GRE tunnel | JSA112186 |
The other nine are narrower, because they need a configured peer, a specific feature or an authenticated user. Four of them (CVE-2026-101950, 101980, 102175 and 33789) are also described as unauthenticated, but need SVR, Extended Echo, a controlled SDX server or BMP:
| CVE | Component | Condition |
|---|---|---|
| CVE-2026-101950 | SVR on SRX | Heap overflow from malformed IPv4 packets on a Secure Vector Routing interface; DoS and potential compromise |
| CVE-2026-101980 | Kernel, Extended Echo | Integer underflow; unauthenticated DoS (kernel crash) when system extended-echo is set |
| CVE-2026-101982 | rpd | Configured BGP/EVPN peer; root code execution on Junos OS (crash on Evolved) via EVPN-VPWS routes |
| CVE-2026-101990 | rpd | Configured BGP peer; crash, or code execution on Junos OS, via a flow-spec update |
| CVE-2026-102178 | rpd | Configured BGP flowspec peer, with update-threading enabled |
| CVE-2026-102175 | sdxd | Attacker must control or intercept the configured SDX/SRC server connection; root code execution |
| CVE-2026-33789 | rpd | "Unauthenticated BGP peer"; needs BMP enabled; DoS and potential root command execution |
| CVE-2026-33796 | rpd | Configured external BGP neighbor; root commands via BMP route monitoring |
| CVE-2026-102031 | TACACS+, Junos OS Evolved | Command injection (CWE-78) by a low-privileged TACACS+-authenticated user; periodic authorization refresh enabled |
Why it matters
Junos runs on routers, firewalls and switches at network edges, so root on one of them is a position in the network path, not a single-host problem. We covered the same class of risk in three unauthenticated Cisco Nexus root RCEs and a Cisco SD-WAN Manager auth bypass.
CISA's SSVC assessment, attached to Juniper's records, is explicit: for CVE-2026-101956, 101983, 101986, 102182, 33789, 33792 and 33796 it lists exploitation "none", automatable "yes" and technical impact "total". CISA's block is absent from seven records (101950, 101954, 101982, 101990, 102031, 102175 and 102178), so we make no claim about them; CVE-2026-101980 has one, rated exploitation none, automatable yes, technical impact partial. We found no internet-exposure data (Shodan, Censys or Shadowserver) for these flaws, so how many devices expose J-Web or IKE is unknown.
Technical details
J-Web. Four of the unauthenticated bugs sit in the web management service. Juniper lists [system services web-management ...] as the relevant configuration for CVE-2026-101954, 101956 and 101986. CVE-2026-101983 applies only when a J-Web virtual domain with mutual TLS is configured (system services web-management https virtual-domain <name> mtls). CVE-2026-101956 affects Junos OS only; the others affect Junos OS and Junos OS Evolved.
MX IKE overflow. CVE-2026-102182 is a stack overflow in the key management daemon, kmd, reached through certificate-based IKE packets. It affects MX Series only. Juniper's structured data gives the fixed releases listed below. Its free-text description also names older trains (before 21.2R3-S11, and the 21.4, 22.2, 22.3 and 22.4 trains) as affected, so check older MX software too.
The rpd cluster. Five bugs are stack overflows in the routing daemon, reached by configured BGP peers, and several need BMP, EVPN or flowspec. They matter most for operators who accept routes from peers they do not fully control.
CVE-2026-102031. Juniper assigns PR:N to this score even though its description requires a TACACS+-authenticated user, so the 9.8 overstates the exposure. NVD has not scored it.
Fixed releases. For CVE-2026-101954 and CVE-2026-102182, Juniper lists these fixes (the same set appears across JSA112187):
- Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and later.
- Junos OS Evolved (CVE-2026-101954): 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and later.
Two cautions. The 23.2, 23.4 and 24.2 fixes (and the matching Evolved trains) are respins: Juniper rebuilt previously published versions, so a matching version string alone does not prove a device is patched. And 23.4X100-EVO is listed as affected with no fixed build. Not every CVE has the same list: CVE-2026-101956, for example, lists fixes only from 25.2R2-S2 upward. Use the JSA for each flaw.
What defenders should do
- Map the JSAs to your platform. JSA112187 covers most of the J-Web and
rpdbugs, JSA112188 CVE-2026-101956 and CVE-2026-101980, JSA112186 the SRX bugs, JSA112196 the MXkmdflaw and JSA112250 the Evolved TACACS+ flaw. - Treat J-Web exposure as the first priority. Juniper says there are no known workarounds for these bugs, so patching is the fix. Until then, restrict J-Web to management networks, as with the exploited PAN-OS management interface bug; that is generic hardening, not a Juniper-endorsed mitigation.
- Check the respin caveat before marking a 23.2, 23.4 or 24.2 device as done.
- On MX Series, list devices that terminate IKE with certificate authentication.
- Review BGP, BMP, EVPN and flowspec configuration against the
rpdbugs. For CVE-2026-33789 Juniper's workaround is to disable BMP or avoidfamily inet flow. - Check Evolved TACACS+ settings for
authorization-time-interval. - Watch logs for unexpected configuration commits, new users or unfamiliar J-Web sessions. There are no published indicators; this is hygiene, not detection of a known campaign.
What is still unclear
- Exploitation. Juniper's records say Juniper SIRT is not aware of malicious exploitation; the CISA KEV catalog released 2026-10-15 lists none of the 15. That can change.
- Exposure. No internet-scan counts are available.
- NVD analysis is pending; scores may be revised.
- The wider bulletin. Secondary reporting describes more fixes than the 15 critical CVEs covered here; we verified only these.
Sources
- Juniper SIRT CVE records via CVE.org, e.g. CVE-2026-101954, CVE-2026-102182; advisories JSA112186, JSA112187, JSA112188, JSA112196, JSA112250 (referenced from the records; portal not readable)
- NVD records: CVE-2026-101954, CVE-2026-101986, CVE-2026-102182, CVE-2026-33796, CVE-2026-102031
- CISA Known Exploited Vulnerabilities catalog
- SecurityOnline, Juniper patches critical Junos OS vulnerabilities (secondary)