Juniper patches about two dozen critical Junos flaws, including root-level J-Web bugs

Juniper Networks released its October security bulletins on October 14, fixing more than 150 vulnerabilities in Junos OS and Junos OS Evolved, the operating systems that run its routers, switches and SRX firewalls, according to SecurityWeek. About two dozen of the flaws are rated critical and can allow code or command execution with root privileges or complete device takeover. Because Junos devices sit at the edge and core of many enterprise and service provider networks, the batch deserves prompt attention even though no exploitation has been reported.

What happened

SecurityWeek reported that Juniper published 17 advisories addressing the Junos flaws, as well as four bugs in the Juniper Cloud-Native Router (JCNR). Besides the critical issues, which can also cause kernel panics, crashes, Routing Engine reboots and service disruption, several high-severity flaws could lead to remote code execution or denial of service.

SecurityOnline, which summarized the bulletins, said the largest is JSA112187, covering more than 60 routing and management bugs across Junos OS and Junos OS Evolved, with separate bulletins for standalone Junos OS (JSA112188), MX Series (JSA112196), SRX Series (JSA112186) and Junos OS Evolved (JSA112250).

Technical details

According to SecurityOnline, flaws rated CVSS 9.8 include:

• CVE-2026-102182: certificate-based IKE packets can lead to root-level code execution on MX Series devices.
• CVE-2026-101954, CVE-2026-101986 and CVE-2026-101956: J-Web issues enabling unauthenticated device takeover, pre-authentication CGI execution or root command execution when J-Web is enabled.
• CVE-2026-33796: remote root command execution when BMP route monitoring is enabled.
• CVE-2026-33792: remote code execution and denial of service on SRX Series when a GRE tunnel is configured.
• CVE-2026-102031: a low-privileged TACACS+ user can gain root command execution on Junos OS Evolved when authorization refresh is enabled.

Many of the issues depend on specific features being enabled. Reports differed on which CVE identifier corresponds to some J-Web flaws, so administrators should confirm details in Juniper's own advisories.

Who is affected

SecurityOnline reported that Junos OS releases before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2 are affected, along with the corresponding Junos OS Evolved releases. Organizations with J-Web exposed to untrusted networks face the highest risk from the most severe bugs.

What to do

SecurityWeek noted that neither F5 nor Juniper mentioned any of the vulnerabilities being exploited in the wild, and SecurityOnline reported that Juniper said there are no known workarounds covering all issues. Administrators should:

• Upgrade to a fixed Junos OS or Junos OS Evolved release listed in the relevant bulletin; for the 23.2, 23.4 and 24.2 trains, Juniper advises installing the rebuilt respins.
• Disable J-Web where it is not needed, or restrict access to trusted management hosts.
• Review whether features named in the advisories, such as BMP, GRE tunnels, IKE with certificates or TACACS+ authorization refresh, are enabled to prioritize devices.

In the same report, SecurityWeek said F5 fixed 11 NGINX defects, including three critical memory bugs that could lead to remote code execution if ASLR is disabled or bypassed.