Latest Junos OS Evolved vulnerability: CVE-2026-21902 #
Juniper Networks disclosed certain versions of Junos OS Evolved on PTX series routers contain a vulnerability in the On-Box Anomaly Detection framework. A remote, unauthenticated adversary could exploit this by sending crafted requests to an affected system to bypass authentication and execute code with root access. The vulnerability has been designated CVE-2026-21902 and has been rated critical with a CVSS score of 9.8.
The following versions are affected
- Junos OS Evolved on PTX Series versions 25.4 through 25.4R1-S1-EVO
- Junos OS Evolved on PTX Series versions prior to 25.4R2-EVO
What is Junos OS Evolved? #
Junos OS Evolved is a next generation network operating system made by Juniper Networks that power many of their high-end routing and data center platforms.
What is the impact? #
Successful exploitation of the vulnerability could allow an adversary the ability to remotely execute code as the root user. This would allow them to take complete control of the device.
Are updates or workarounds available? #
Administrators are encouraged to update to the latest version as soon as possible. Additionally, administrators can disable the affected service on vulnerable devices using the following:
request pfe anomalies disableHow to find potentially vulnerable systems with runZero #
From the Service Inventory, use the following query to locate potentially impacted assets:
os:="Juniper Junos OS Evolved" AND
((os_version:>="25.4R1-EVO" AND os_version:<"25.4R1-S1-EVO") OR
(os_version:>"25.4R1-S1-EVO" AND os_version:<"25.4R2-EVO"))Note: The query locates all potentially vulnerable Junos OS Evolved installations. However, it does not specifically identify PTX Series routers.
