Among the nine critical Junos OS and Junos OS Evolved vulnerabilities published in October 2026, two are authentication failures in J-Web rather than memory corruption. CVE-2026-101954 and CVE-2026-101986 are easy to skim past because they look similar, but they break different assumptions and produce different attacker outcomes, and both are rated 9.8 on the CVSS v3.1 scale.
Vulnerability overview
CVE-2026-101954 is an improper authentication flaw in the J-Web management interface and its NETCONF session handling. NVD states that an unauthenticated network attacker can obtain root-level device configuration access and take over the device through a reachable J-Web HTTP or HTTPS service when web management is enabled.
CVE-2026-101986 is also an improper authentication flaw in J-Web, described as an authentication bypass that lets an unauthenticated network attacker execute CGI content with elevated privileges via a crafted HTTP request.
NVD published both entries on 2026-10-14 with a CVSS v3.1 base score of 9.8, a CVSS v4.0 score of 9.3, and the status "Awaiting Analysis". Neither is listed in CISA's Known Exploited Vulnerabilities catalog version 2026.10.23.
Mechanism and exploitation conditions
CVE-2026-101954 reaches further than a login bypass. The description names NETCONF session handling as part of the affected surface, which suggests the authentication decision is being made incorrectly somewhere between the web front end and the session layer that carries configuration operations. The consequence the vendor states is root-level configuration access, not merely read access to status pages.
CVE-2026-101986 is scoped to CGI execution with elevated privileges. That is a different primitive: the attacker does not necessarily receive a management session, but they can get code running with privileges they should never have reached through an unauthenticated HTTP request.
Both flaws share the same enabling condition. J-Web must be enabled and reachable on HTTP or HTTPS from the attacker's network position. Devices with web management disabled, or firewalled to a small administrative subnet, do not present this path.
Public material at the time of writing does not include request-level reproduction detail, and no source in this research claims in-the-wild exploitation. The scoring indicates that exploitation is considered straightforward once the interface is reachable, which is why the fixed releases matter more than the mechanism detail.
Impact
Because the outcome is configuration access at root level, an attacker who finds a reachable, unpatched J-Web interface can read and change anything the operator can. That includes administrative accounts, routing policy, firewall filters and logging destinations. Persistence is trivial: create a new user, relax a filter, or alter what gets logged. Rolling back means treating the device as compromised, not as merely vulnerable.
The CGI variant produces elevated code execution without the same session semantics, which changes how the compromise appears in logs. An operator who only looks for failed or successful admin logins may miss it entirely.
Affected products and scope
Both CVEs were fixed in the same October 2026 builds. Junos OS is affected on all versions prior to 23.2R2-S7.7, and separately on 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3 and 26.2 before 26.2R1-S2.
Junos OS Evolved is affected on all versions prior to 23.2R2-S7.7-EVO, plus 23.4 before 23.4R2-S8.11-EVO, 24.2 before 24.2R2-S5.6-EVO, 24.4 before 24.4R2-S5-EVO, 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, 26.2 before 26.2R1-S2-EVO, the 23.4X100-EVO branch, 25.2X100 before 25.2X100-D35-EVO and 25.4X300 before 25.4X300-D40-EVO.
The configuration dependency is the part that decides urgency for a specific network. An operator whose entire Junos estate has no web management enabled has a very different exposure profile from one where J-Web is exposed to the corporate LAN for convenience.
Exposure context
ZoomEye data for app="Juniper" shows 343,949 matching assets globally. That is a product-level view, not a count of devices with J-Web reachable, and it says nothing about patch level. It does support one practical conclusion: Juniper platforms are common enough on the public internet that assumptions about obscurity are not a control.
Remediation and validation
Move to the fixed builds for the deployed branch. Where patching must wait, disable J-Web where it is not operationally required, and restrict reachability to a dedicated administrative network with a jump host. Restriction is mitigation, not remediation: the flaw remains present.
Post-change validation should confirm that the HTTP and HTTPS management services are in the expected state, that no unexpected administrative accounts exist, and that configuration differences on exposed devices are reviewed rather than accepted. For any device that was reachable and unpatched, a configuration audit before and after the upgrade is the minimum honest response.
References
Juniper security bulletin, October 2026: https://supportportal.juniper.net/s/article/2026-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Multiple-vulnerabilities-resolved
NVD record for CVE-2026-101954: https://nvd.nist.gov/vuln/detail/CVE-2026-101954
NVD record for CVE-2026-101986: https://nvd.nist.gov/vuln/detail/CVE-2026-101986
CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog