Juniper fixed dozens of critical router and firewall bugs. Close J-Web to the internet and plan Junos upgrades

Juniper published its October security bulletins for Junos OS and Junos OS Evolved on Wednesday, and the list is long. The combined bulletin alone covers more than 60 bugs, and several are rated 9.8, including two that let someone take over a device through the J-Web admin page without logging in.

Juniper says it found them in its own testing and knows of no attacks. That gives router and firewall teams a short window to plan upgrades before anyone reverse-engineers the fixes.

Juniper found more than 60 Junos bugs in its own testing. Nobody is attacking them yet, which makes this the easy week to upgrade.
The 5-Minute Cyber Brief
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Email address
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.

Juniper ships its October Junos bulletins

The main bulletin, JSA112187, covers Junos OS and Junos OS Evolved. In it, CVE-2026-101954 allows a full device takeover with no authentication when J-Web is enabled, and CVE-2026-101986 lets a request run CGI code in J-Web before login. CVE-2026-33796 allows remote root commands on routers with BMP route monitoring turned on.

Separate bulletins cover specific hardware. On SRX firewalls (JSA112186), CVE-2026-33792 allows remote code execution when a GRE tunnel is configured. On MX routers (JSA112196), CVE-2026-102182 lets certificate-based IKE packets run code as root. In Junos OS Evolved (JSA112250), CVE-2026-102031 lets a low-privileged TACACS+ user run root commands when authorization refresh is enabled.

J-Web on the internet is the worst case

Juniper’s statement in each bulletin is that the issues “were found during extensive internal product security testing” and that its SIRT “is not aware of any malicious exploitation.” No public proof-of-concept code has been reported.

The exposure depends on configuration. A J-Web page reachable from the internet is the worst case. GRE tunnels on SRX, IKE with certificates on MX and BMP monitoring are common in branch and service-provider setups, so the router team will know quickly which bulletins apply. Juniper says there are no known workarounds for all of the issues.

Close J-Web, then schedule Junos upgrades

Find any Junos device with J-Web reachable from outside the management network. Disable J-Web or restrict it to trusted admin addresses today.
Upgrade Junos OS to 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 or later. Junos OS Evolved has matching -EVO releases.
On 23.2, 23.4 and 24.2, install the rebuilt respins Juniper lists rather than an older build with the same name.
Check the per-CVE records for individual workarounds on SRX GRE, MX IKE and BMP setups you cannot upgrade this week.

Forward this

For our network team: Juniper published October fixes for dozens of critical Junos bugs, including two that let someone take over a device through J-Web with no login. Juniper says nobody is exploiting them yet. Can we confirm J-Web is not reachable from the internet on any router or SRX, and book the Junos upgrades?

Details

JSA112187 (Junos OS and Evolved): CVE-2026-101954 and CVE-2026-101986 (J-Web, unauthenticated, 9.8), CVE-2026-33796 (BMP, 9.8), CVE-2026-102175 (service deployment, 9.8).
JSA112186 (SRX): CVE-2026-33792 (GRE, 9.8), CVE-2026-101950 (Secure Vector Routing crash, 9.8).
JSA112196 (MX): CVE-2026-102182 (certificate-based IKE, root code execution, 9.8).
JSA112250 (Junos OS Evolved): CVE-2026-102031 (TACACS+ authorization refresh, 9.8).
Exploitation: none known, per Juniper SIRT. Bulletins published October 14, 2026.

Hunt / verify

External scan results for J-Web on TCP 80 and 443 at your Junos management addresses.
Junos configs with system services web-management enabled on interfaces that face untrusted networks.
Unexpected reboots or rpd crashes in the logs since October 14, which can point to probing of the denial-of-service bugs.

Source: Juniper JSA112187; SecurityOnline summary of the October bulletins

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].