Vulnerability · Published Oct 14, 2026 · Assigned by juniper

CVE-2026-102079Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands allows command injection

High 7.8

In plain English

A high-severity OS command injection in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.7%top 48.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device. A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification. This issue affects Junos OS: * 24.4 versions before 24.4R2-S4; * 25.2 versions before 25.2R2-S1; * 25.4 versions before 25.4R1-S3; This issue does not affect Junos OS releases before 24.4R1.

Affected products (as reported)

Vendor	Product	Versions
Juniper Networks	Junos OS	24.4 – before 24.4R2-S425.2 – before 25.2R2-S125.4 – before 25.4R1-S3

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://supportportal.juniper.net/JSA112180 vendor-advisory