CVE-2026-21902: critical vulnerability in Juniper Networks Junos OS Evolved
Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root
Published · Updated
75Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actcvss 9.3epss 18%
from disclosure to weapon3 days
Published on NVDFeb 25
1st PoC+3d
VulnCheck+17d
exploitation probability
18%top 3% of all CVEs
observed exploitation
yesVulnCheck
2 public exploit(s)
An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root.
The On-Box Anomaly detection framework should only be reachable by other internal processes over the internal routing instance, but not over an externally exposed port. With the ability to access and manipulate the service to execute code as root a remote attacker can take complete control of the device.
Please note that this service is enabled by default as no specific configuration is required.
This issue affects Junos OS Evolved on PTX Series:
* 25.4 versions before 25.4R1-S1-EVO, 25.4R2-EVO.
This issue does not affect Junos OS Evolved versions before 25.4R1-EVO.
This issue does not affect Junos OS.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:M/U:Red
Affected products
Juniper Networks · Junos OS Evolvedpublic PoCs found — 2
cve_referencegithub.com/watchtowrlabs/watchTowr-vs-JunosEvolved-CVE-2026-21902/blob/main/watchTowr-vs-JunosEvolved-CVE-2026-21902.pyunverifiedvulncheckvulncheck.com/xdb/d8f09a8c7277unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Juniper Networks Junos OS Evolved
In the same product, most dangerous first.
CVE-2023-28983HIGHJunos OS Evolved: Shell Injection vulnerability in the gNOI serverEPSS 1.5%CVE-2020-1626HIGHJunos OS Evolved: Denial of Service vulnerability in processing high rate of specific packetsEPSS 1.4%CVE-2020-1638HIGHJunos OS & Junos OS Evolved: A specific IPv4 packet can lead to FPC restart.EPSS 1.3%CVE-2021-0211CRITICALJunos OS and Junos OS Evolved: Upon receipt of a specific BGP FlowSpec message network traffic may be disrupted.EPSS 1.3%CVE-2020-1662HIGHJunos OS and Junos OS Evolved: RPD crash due to BGP session flapping.EPSS 1.3%CVE-2020-1648HIGHJunos OS and Junos OS Evolved: RPD crash when processing a specific BGP packetEPSS 1.3%