All vulnerabilities
CVE-2026-102079

Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands allows command injection

Juniper Networks Junos OSNetwork & edge
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.66%Chance of exploitation activity in the next 30 days, higher than 50% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in24.4R2-S4Also 25.2R2-S1, 25.4R1-S3CVE List
Published14 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device.

A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification.

This issue affects Junos OS:

  • 24.4 versions before 24.4R2-S4;
  • 25.2 versions before 25.2R2-S1;
  • 25.4 versions before 25.4R1-S3;

This issue does not affect Junos OS releases before 24.4R1.

Text from CVE List

Affected versions 3

  • Junos OSaffected: 24.4 before 24.4R2-S4CVE List
  • Junos OSaffected: 25.2 before 25.2R2-S1CVE List
  • Junos OSaffected: 25.4 before 25.4R1-S3CVE List

References 1