---
title: Hunt: internet-exposed Juniper J-Web / web-management after CVE-2026-101954 | ctxsec
url: https://ctxsec.com/items/hunt-juniper-jweb-exposure
description: ""
status: "hunt idea"
published: 2026-10-14
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-juniper-jweb-exposure.md)

hunt idea

2026-10-14

### Hunt: internet-exposed Juniper J-Web / web-management after CVE-2026-101954

CVE-2026-101954 is unauthenticated root-level takeover when J-Web HTTP/HTTPS is reachable. Hunt for Junos devices with web-management enabled on untrusted interfaces, unexpected successful unauthenticated hits to J-Web paths, and post-advisory config changes that add admin users or NETCONF sessions. Pair with MX Series logs for anomalous IKE certificate-based exchanges (CVE-2026-102182) and SRX Security Intelligence feed-fetch anomalies (CVE-2026-102062). Vendor states no known malicious exploitation yet — treat as priority exposure reduction.

Sources: [CVE-2026-101954](https://www.cve.org/CVERecord?id=CVE-2026-101954) · [CVE-2026-102182](https://www.cve.org/CVERecord?id=CVE-2026-102182)