All vulnerabilities
CVE-2026-101983

Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured

Juniper Networks Junos OSNetwork & edge
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.54%Chance of exploitation activity in the next 30 days, higher than 44% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in23.4R2-S8.13Also 24.2R2-S5.5, 24.4R2-S5 and 11 moreCVE List
Published14 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

Show all 14 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.

Text from CVE List

Affected versions 15

  • Junos OSaffected: 23.4 before 23.4R2-S8.13CVE List
  • Junos OSaffected: 24.2 before 24.2R2-S5.5CVE List
  • Junos OSaffected: 24.4 before 24.4R2-S5CVE List
  • Junos OSaffected: 25.2 before 25.2R2-S2CVE List
  • Junos OSaffected: 25.4 before 25.4R1-S3CVE List
  • Junos OSaffected: 26.2 before 26.2R1-S2CVE List
  • Junos OS Evolvedaffected: 23.4 before 23.4R2-S8.11-EVOCVE List
  • Junos OS Evolvedaffected: 24.2 before 24.2R2-S5.6-EVOCVE List
  • Junos OS Evolvedaffected: 24.4 before 24.4R2-S5-EVOCVE List
  • Junos OS Evolvedaffected: 25.2 before 25.2R2-S2-EVOCVE List
  • Junos OS Evolvedaffected: 25.4 before 25.4R1-S3-EVOCVE List
  • Junos OS Evolvedaffected: 26.2 before 26.2R1-S2-EVOCVE List
  • Junos OS Evolvedaffected: 23.4X100CVE List
  • Junos OS Evolvedaffected: 25.2X100 before 25.2X100-D35-EVOCVE List
  • Junos OS Evolvedaffected: 25.4X300 before 25.4X300-D40-EVOCVE List

References 1