---
title: Juniper Oct 14 Junos advisories: two unauth-root J-Web flaws (CVE-2026-101954, CVE-2026-101956), MX IKE (CVE-2026-102182), Secure-ZTP DHCP, SecIntel feeds | ctxsec
url: https://ctxsec.com/items/juniper-oct-2026-junos-rce
description: ""
status: "confirmed (vendor CVE); no known exploitation, last updated Oct 18, 2026, 3:57 PM ET"
published: 2026-10-14
updated: 2026-10-18T15:57:00-04:00
---

> 

[← Cybersecurity News](/news) · [markdown](/items/juniper-oct-2026-junos-rce.md)

confirmed (vendor CVE); no known exploitation

2026-10-14 · updated

Oct 18, 2026, 3:57 PM ET

### Juniper Oct 14 Junos advisories: two unauth-root J-Web flaws (CVE-2026-101954, CVE-2026-101956), MX IKE (CVE-2026-102182), Secure-ZTP DHCP, SecIntel feeds

Juniper SIRT published a cluster of Oct 14 CVEs for Junos OS / Junos OS Evolved. Highest-priority internet-facing issues include: CVE-2026-101954 (CVSS 4.0 9.3 / 3.1 9.8) — improper authentication in J-Web / NETCONF that lets an unauthenticated network attacker get root-level config access when web management is enabled (JSA112187); CVE-2026-102182 (9.3/9.8) — stack buffer overflow in kmd on MX Series via crafted IKE certificate packets for unauthenticated root RCE (JSA112196); CVE-2026-102175 (9.3/9.8) — heap overflow in sdxd if an attacker controls or intercepts the configured SDX/SRC service-deployment connection; CVE-2026-102061 (8.7/8.8) — Secure-ZTP phone-home (phcd) stack overflow from a crafted adjacent DHCP SZTP bootstrap (platforms with Secure-ZTP only); CVE-2026-102062 (9.2/8.1) — format-string in SRX ipfd if Security Intelligence uses a compromised or impersonated HTTPS feed server; CVE-2026-102031 — Junos OS Evolved TACACS+ OS command injection to root when authorization-refresh is enabled (low-privileged TACACS+ user). Patched builds include 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2 and later (plus matching -EVO). Juniper SIRT states it is not aware of malicious exploitation of these issues. Not on CISA KEV as of catalogVersion 2026.10.14. Update (Oct 18): a second J-Web flaw from the same release, CVE-2026-101956 (JSA112188, CVSS 4.0 9.3 / 3.1 9.8), is improper authentication that lets an unauthenticated remote attacker run arbitrary Junos commands as root when J-Web is exposed. It's fixed in 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2. If you can't upgrade, disable J-Web or limit it to a management network.

Sources: [CVE-2026-101954](https://www.cve.org/CVERecord?id=CVE-2026-101954) · [CVE-2026-102182](https://www.cve.org/CVERecord?id=CVE-2026-102182) · [CVE-2026-102061](https://www.cve.org/CVERecord?id=CVE-2026-102061) · [CVE-2026-102062](https://www.cve.org/CVERecord?id=CVE-2026-102062) · [Juniper JSA112187](https://supportportal.juniper.net/JSA112187) · [Juniper JSA112196](https://supportportal.juniper.net/JSA112196) · [CVE-2026-101956 (Juniper JSA112188)](https://www.cve.org/CVERecord?id=CVE-2026-101956)