Juniper SIRT published a cluster of Oct 14 CVEs for Junos OS / Junos OS Evolved. Highest-priority internet-facing issues include: CVE-2026-101954 (CVSS 4.0 9.3 / 3.1 9.8) — improper authentication in J-Web / NETCONF that lets an unauthenticated network attacker get root-level config access when web management is enabled (JSA112187); CVE-2026-102182 (9.3/9.8) — stack buffer overflow in kmd on MX Series via crafted IKE certificate packets for unauthenticated root RCE (JSA112196); CVE-2026-102175 (9.3/9.8) — heap overflow in sdxd if an attacker controls or intercepts the configured SDX/SRC service-deployment connection; CVE-2026-102061 (8.7/8.8) — Secure-ZTP phone-home (phcd) stack overflow from a crafted adjacent DHCP SZTP bootstrap (platforms with Secure-ZTP only); CVE-2026-102062 (9.2/8.1) — format-string in SRX ipfd if Security Intelligence uses a compromised or impersonated HTTPS feed server; CVE-2026-102031 — Junos OS Evolved TACACS+ OS command injection to root when authorization-refresh is enabled (low-privileged TACACS+ user). Patched builds include 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2 and later (plus matching -EVO). Juniper SIRT states it is not aware of malicious exploitation of these issues. Not on CISA KEV as of catalogVersion 2026.10.14. Update (Oct 18): a second J-Web flaw from the same release, CVE-2026-101956 (JSA112188, CVSS 4.0 9.3 / 3.1 9.8), is improper authentication that lets an unauthenticated remote attacker run arbitrary Junos commands as root when J-Web is exposed. It's fixed in 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2. If you can't upgrade, disable J-Web or limit it to a management network.