CVE-2026-101983
9.8CriticalPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-121
Impact
Unauthenticated attackers can achieve remote code execution or crash the device over the network. They only need network access to the httpd service with a J-Web virtual-domain configured.
Root cause
A stack-based buffer overflow in the httpd process handling J-Web virtual domains.
Affected systems
Juniper Networks Junos OS and Junos OS Evolved (specific version ranges not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to the patched Junos OS/Junos OS Evolved release referenced in advisory JSA112187; as an immediate mitigation, disable J-Web or restrict access to the httpd service and virtual domains using firewall filters.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.