Vulnerability · Published Jan 15, 2026 · Assigned by juniper

CVE-2026-21907Junos Space: TLS/SSL server supports use of static key ciphers (ssl-static-key-ciphers)

Medium 5.9

In plain English

A medium-severity broken cryptography in Junos Space from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 89.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A Use of a Broken or Risky Cryptographic Algorithm vulnerability in the TLS/SSL server of Juniper Networks Junos Space allows the use of static key ciphers (ssl-static-key-ciphers), reducing the confidentiality of on-path traffic communicated across the connection. These ciphers also do not support Perfect Forward Secrecy (PFS), affecting the long-term confidentiality of encrypted communications.This issue affects all versions of Junos Space before 24.1R5.

Affected products (as reported)

Vendor	Product	Versions
Juniper Networks	Junos Space	0 – before 24.1R5

Weakness: CWE-327 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://supportportal.juniper.net/JSA106006 vendor-advisory
https://kb.juniper.net/JSA106006 vendor-advisory