CVE-2026-21902

CVE Enrichment

CVSS: 9.3 CRITICAL
EPSS: 18.48%
EPSS Percentile: 97.26%
CISA KEV: Not listed

Description

An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root. The On-Box Anomaly detection framework should only be reachable by other internal processes over the internal routing instance, but not over an externally exposed port. With the ability to access and manipulate the service to execute code as root a remote attacker can take complete control of the device. Please note that this service is enabled by default as no specific configuration is required. This issue affects Junos OS Evolved on PTX Series: * 25.4 versions before 25.4R1-S1-EVO, 25.4R2-EVO. This issue does not affect Junos OS Evolved versions before 25.4R1-EVO. This issue does not affect Junos OS.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 26-Feb-2026 01:23
Last Modified: 17-Jun-2026 17:19
EPSS Date: 2026-11-07
CWE: CWE-732

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:L /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:Y /
                            R:U /
                            V:X /
                            RE:M /
                            U:Red

CNA Products / Version Status

Juniper Networks · Junos OS Evolved Source: CNA · [email protected]
Default status: unaffected

25.4 ≤ version < 25.4R1-S1-EVO, 25.4R2-EVO — affected (semver)
0 ≤ version < 25.4R1-EVO — unaffected (semver)

Platforms: PTX Series

Affected Products / Versions

juniper / junos_os_evolved Source: NVD CPE · affected
Version / affected range: 25.4
cpe:2.3:o:juniper:junos_os_evolved:25.4:r1:*:*:*:*:*:*

References

Last enrichment sync: 08-Nov-2026 13:25
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Top critical IT flaws include CVE-2026-21902 (Juniper Junos RCE/auth bypass), CVE-2026-20127 (Cisco SDâWAN auth bypass), and CVE-2026-29000 (pac4jâjwt token forgery). Cyble Tracks 1,641 Vulnerabilities, Including Critical IT and ICS Flaws

CVE (10)

MITRE ATT&CK (5)

Vendors (11)

Products (7)

Industries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.