Juniper Releases Fixes for Critical Unauthenticated J-Web RCE Vulnerability

Juniper Networks has addressed a critical vulnerability in its Junos OS and Junos OS Evolved operating systems. The issue, tracked as CVE-2026-101983, allows unauthenticated attackers to execute remote code or cause denial of service.

What happened

A stack-based buffer overflow exists in the httpd process of Juniper Networks Junos OS and Junos OS Evolved. According to the National Vulnerability Database, this weakness, classified as CWE-121, enables an unauthenticated network attacker to trigger remote code execution. The attack vector requires a J-Web virtual domain to be configured on the device. The flaw allows for both remote code execution and denial of service impacts.

The vulnerability affects multiple branches of Juniper’s operating systems. Affected versions include Junos OS releases before 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, and 25.2R2-S2. Junos OS Evolved is also vulnerable in versions before 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, and 25.2R2-S2-EVO. Patches are available for these specific service releases.

Why it matters

The National Vulnerability Database assigns a CVSS score of 9.8 to CVE-2026-101983, rating it as Critical. Another NVD record lists the score as 9.3, also Critical. The high severity stems from the lack of authentication required to exploit the flaw. An attacker on the network can target the J-Web interface without credentials. Successful exploitation leads to full remote code execution on the device. This level of access compromises the integrity and availability of the network infrastructure.

What to watch

• Monitor for new exploit attempts targeting J-Web interfaces on unpatched devices.
• Review logs for unusual httpd process activity or unexpected virtual domain configurations.
• Verify that all Junos OS and Junos OS Evolved devices are updated to the fixed versions.
• Check for any additional vulnerabilities disclosed in the same release cycle.

Who needs to act first

Teams should prioritize updating systems that expose J-Web to untrusted networks. Check whether external-facing devices are running vulnerable versions of Junos OS or Junos OS Evolved. Roll out patches to these exposed systems first to reduce immediate risk. Test the updates in a non-production environment before wide deployment. Back up configurations prior to applying changes. If immediate patching is not possible, restrict access to J-Web using network controls.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Juniper Networks

• Identify all devices running vulnerable versions of Junos OS or Junos OS Evolved.
• Apply the latest service release patches provided by Juniper Networks.
• Restrict network access to J-Web interfaces if immediate patching is not feasible.
• Monitor system logs for signs of exploitation attempts or unauthorized access.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-101983?

The National Vulnerability Database lists the CVSS score as 9.8, rated Critical.

Which Juniper products are affected by this vulnerability?

Junos OS and Junos OS Evolved versions prior to specific service releases are affected.

Is authentication required to exploit this flaw?

No, the vulnerability allows unauthenticated network attackers to execute remote code.