Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-101983 EUVD-2026-101309GHSA-wg6r-2r3p-3vc7

Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured

Published Oct 14, 2026 · Updated Oct 15, 2026 · Assigned by juniper

Vendor: Juniper Networks Product: Junos OS Product: Junos OS Evolved Category: Network devices

Description

A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.

Affected products

VendorProductAffectedFixed
Juniper Networks Junos OS 23.4 – < 23.4R2-S8.13, 24.2 – < 24.2R2-S5.5, 24.4 – < 24.4R2-S5, 25.2 – < 25.2R2-S2, 25.4 – < 25.4R1-S3, 26.2 – < 26.2R1-S2 23.4R2-S8.13
Juniper Networks Junos OS Evolved 23.4 – < 23.4R2-S8.11-EVO, 24.2 – < 24.2R2-S5.6-EVO, 24.4 – < 24.4R2-S5-EVO, 25.2 – < 25.2R2-S2-EVO, 25.4 – < 25.4R1-S3-EVO, 26.2 – < 26.2R1-S2-EVO, 23.4X100, 25.2X100 – < 25.2X100-D35-EVO, 25.4X300 – < 25.4X300-D40-EVO 23.4R2-S8.11-EVO

References