Vulnerability Intelligence Report
Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured
CVE-2026-101983
A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-121 ↗CWE-121 Stack-based Buffer Overflow
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Juniper Networks | Junos OS | 23.4 < 23.4R2-S8.13 (affected), 24.2 < 24.2R2-S5.5 (affected), 24.4 < 24.4R2-S5 (affected), 25.2 < 25.2R2-S2 (affected), 25.4 < 25.4R1-S3 (affected), 26.2 < 26.2R1-S2 (affected) |
| Juniper Networks | Junos OS Evolved | 23.4 < 23.4R2-S8.11-EVO (affected), 24.2 < 24.2R2-S5.6-EVO (affected), 24.4 < 24.4R2-S5-EVO (affected), 25.2 < 25.2R2-S2-EVO (affected), 25.4 < 25.4R1-S3-EVO (affected), 26.2 < 26.2R1-S2-EVO (affected), 23.4X100 (affected), 25.2X100 < 25.2X100-D35-EVO (affected), 25.4X300 < 25.4X300-D40-EVO (affected) |
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Juniper Networks, Inc. · Vendor · USA |
| Reserved | 2026-09-28T16:31:35 |
| Published | 2026-10-14T17:17:37 |
| Patch Date | 2026-10-14 |
| Last Updated | 2026-10-14T17:17:37 |
Community Chatter & Buzz