Network Firewalls, Network Access Control
,
Security Operations
Juniper Tells Customers to Tune Their Firewall
A critical vulnerability in Juniper Networks’ primary operating system could give threat actors root level privileges to execute code on Juniper’s PTX Series routers.
See Also: Securing Patient Data: Shared Responsibility in Action
Tracked as CVE-2026-21902 with a CVSS score of 9.3, the flaw derives from an improper permission assignment in Junos OS Evolved – specifically in the On-Box Anomaly Detection framework that handles internal monitoring and should be accessible only from an internal routing interface.
Researchers at watchTowr notified the company of the flaw. Juniper in a Tuesday advisory told customers to filter access through access lists or firewalls and that it will later develop a patch.
Since the service runs as root and enabled by default, successful exploitation would give attackers full command and control over devices without the need for authentication. In a technical analysis of the flaw, watchTowr researchers said the framework was never purpose built to be accessible in typical deployments but could be made accessible, depending on the OS configuration.
The flaw affects versions 25.4R1-S1-EVO and 25.4R2-EVO on PTX routers. Older versions may be impacted but no evidence of active exploitation in the wild has been reported, Juniper said.
Non-Evolved versions of Junos OS – anything released before 25.4R1-EVO – have shown “no signs of impact,” with Juniper’s security response team reporting no “malicious exploitation of the vulnerability at the time of publishing the security bulletin.”
The PTX series routers are high-performance core and peering routers primarily used as service provider backbones, in telecom environments or at data centers, managing traffic on commercial-scale, carrier-grade and hyper scale environments.
Successful exploitation of CVE-2026-21902 not only allows an attacker to establish persistence with minimal authentication but also manipulate, intercept and reroute traffic while traversing an organization’s infrastructure.