Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2026-21902 EUVD-2026-8693GHSA-5w57-gjvc-whwc

Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root

Published Feb 25, 2026 · Updated Mar 4, 2026 · Assigned by juniper

Vendor: Juniper Networks Product: Junos OS Evolved Category: Network devices

Description

An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root.

The On-Box Anomaly detection framework should only be reachable by other internal processes over the internal routing instance, but not over an externally exposed port. With the ability to access and manipulate the service to execute code as root a remote attacker can take complete control of the device.
Please note that this service is enabled by default as no specific configuration is required.

This issue affects Junos OS Evolved on PTX Series:

* 25.4 versions before 25.4R1-S1-EVO, 25.4R2-EVO.

This issue does not affect Junos OS Evolved versions before 25.4R1-EVO.

This issue does not affect Junos OS.

Affected products

VendorProductAffectedFixed
Juniper Networks Junos OS Evolved 25.4 – < 25.4R1-S1-EVO, 25.4R2-EVO 25.4R1-S1-EVO, 25.4R2-EVO

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 2

References