Juniper Networks this week released an out-of-band update for its Junos OS Evolved network operating system to patch a critical vulnerability.
The vulnerability, tracked as CVE-2026-21902, affects Junos OS Evolved on PTX series high-performance routers.
The issue impacts the On-Box Anomaly detection framework and it can be exploited by an unauthenticated attacker with network access to execute arbitrary code with root privileges.
“The On-Box Anomaly detection framework should only be reachable by other internal processes over the internal routing instance, but not over an externally exposed port,” Juniper said in its advisory.
The company added, “With the ability to access and manipulate the service to execute code as root a remote attacker can take complete control of the device. Please note that this service is enabled by default as no specific configuration is required.”
The security hole has been patched with the release of versions 25.4R1-S1-EVO and 25.4R2-EVO. Junos OS Evolved versions prior to 25.4R1-EVO and Junos OS are not affected.
“If an attacker gains control of a PTX, the impact is bigger than a single device compromise because it can become a traffic vantage point and a control point at the same time,” explained Piyush Sharma, co-founder and CEO of Tuskira. “This opens the door to the stealthy interception of data flows, controller redirected traffic, or easy pivots into adjacent networks.”
Juniper Networks said CVE-2026-21902 was discovered internally and there is no evidence of in-the-wild exploitation.
However, it’s not uncommon for threat actors to exploit vulnerabilities in Juniper products in their attacks. CISA’s KEV catalog currently includes eight flaws whose exploitation was observed in recent years.
“Juniper vulnerabilities have attracted a lot of attention from hackers over the years, due largely in part to the premium positioning they provide if long-term footholds are established,” Sharma said.
Related: Juniper Networks Patches Critical Junos Space Vulnerabilities
Related: Mandiant Uncovers Custom Backdoors on End-of-Life Juniper Routers
Related: Juniper Networks Patches Dozens of Junos Vulnerabilities
Related: Juniper Networks Fixes High-Severity Vulnerabilities in Junos OS
