Answer in brief
CVE-2026-102079 records a High severity (CVSS 8.5) vulnerability in Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands allows command injection. The current sources do not mark it as known exploited. The current feed maps Juniper Networks/Junos OS (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Juniper Networks/Junos OS (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Juniper Networks/Junos OSgeneric | >=24.4 <24.4R2-S4 || >=25.2 <25.2R2-S1 || >=25.4 <25.4R1-S3 | 24.4R2-S4, 25.2R2-S1, 25.4R1-S3 |
Published upstream
Oct 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 14, 2026
An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device. A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification. This issue affects Junos OS: * 24.4 versions before 24.4R2-S4; * 25.2 versions before 25.2R2-S1; * 25.4 versions before 25.4R1-S3; This issue does not affect Junos OS releases before 24.4R1.
Quoted source text, attributed separately from HOL analysis.