Juniper Junos OS October 2026 security release: three unauthenticated J-Web flaws (CVE-2026-101956, -101986, -101983; CVSS 9.8) allow root command or code execution, plus 9.8-rated SRX GRE, MX IKE and BGP Monitoring Protocol bugs

Juniper Networks published its October 2026 Junos OS and Junos OS Evolved security advisories on 14 October 2026, with CVE records for at least 16 issues. The most serious are in J-Web, the built-in web management interface. CVE-2026-101956 (JSA112188) lets an unauthenticated remote attacker run arbitrary Junos commands with root privileges through an exposed J-Web interface. CVE-2026-101986 (JSA112187) bypasses J-Web authentication to run CGI content with elevated privileges using a crafted HTTP request. CVE-2026-101983 is a stack buffer overflow in httpd that an unauthenticated attacker can reach when a J-Web virtual-domain is configured. Juniper rates all three 9.8 (CVSS 3.1) and 9.3 (CVSS 4.0). Other bugs rated 9.8 are CVE-2026-33792, a stack overflow in srxpfe on SRX Series triggered by a crafted packet on a configured GRE tunnel (JSA112186); CVE-2026-102182 in kmd on MX Series via certificate-based IKE packets (JSA112196); and CVE-2026-33789 and CVE-2026-33796 in rpd when BGP Monitoring Protocol (BMP) is enabled (JSA112187). The release also fixes an SRX ADVPN peer-message overflow (CVE-2026-102084), an SRX Security Intelligence feed format-string bug (CVE-2026-102062), an authd overflow reachable with SNMP read access when SNMP and AAA are on (CVE-2026-101979), and a PTX zero-touch provisioning DHCP command injection (CVE-2026-101967), among others. Juniper SIRT says it is not aware of malicious exploitation, and lists no workarounds for the J-Web, GRE and IKE issues. Primary: Juniper's JSA advisories and Juniper-issued CVE records.

Product

Juniper Networks Junos OS and Junos OS Evolved (J-Web, SRX Series srxpfe, MX Series kmd, rpd)

Versions

J-Web CVE-2026-101986: Junos OS before 23.2R2-S7.7, 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3, and the matching Junos OS Evolved -EVO releases. CVE-2026-101983 also affects 26.2 before 26.2R1-S2. CVE-2026-101956: Junos OS 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3, 26.2 before 26.2R1-S2. Other CVEs carry their own version lists in each JSA.

CVSS

9.8 (CVSS 3.1) / 9.3 (CVSS 4.0), Juniper, for CVE-2026-101956, -101986, -101983, -33792, -33796 and -102182; CVE-2026-33789 9.8 / 9.2

Exploited in Australia?

unknown

Patch to

Upgrade Junos OS and Junos OS Evolved to the fixed releases in JSA112186, JSA112187, JSA112188 and JSA112196 (for J-Web, at least 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3 or 26.2R1-S2 for your train). Until then, keep J-Web off internet-facing interfaces and limit it to a trusted management network, or turn it off where it is not used. Check whether GRE tunnels, BGP Monitoring Protocol, certificate-based IKE on MX, ADVPN or zero-touch provisioning are configured, since several bugs need those features.

Primary: Juniper SIRT — JSA112187 (J-Web pre-auth CGI execution CVE-2026-101986, J-Web virtual-domain httpd RCE CVE-2026-101983, rpd BMP CVE-2026-33789 / -33796; 14 Oct 2026) · Vendor: Juniper SIRT — JSA112188 (J-Web unauthenticated root command execution CVE-2026-101956; 14 Oct 2026); also JSA112186 (SRX) and JSA112196 (MX IKE) · CVE: CVE-2026-101956, CVE-2026-101986, CVE-2026-101983, CVE-2026-33792, CVE-2026-102182, CVE-2026-33789, CVE-2026-33796, CVE-2026-102084, CVE-2026-102062, CVE-2026-101979, CVE-2026-101967 · CVE record — CVE-2026-101956 (Juniper CNA; published 14 Oct 2026)

vulnerabilities network