CVE-2026-102079 Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands allows command injection
A local low-privileged attacker can execute arbitrary commands with root privileges via unsanitized input in the CLI, leading to full device control.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-102079?
CVE-2026-102079 is a high-severity command injection vulnerability in Juniper Networks Junos OS, published on 14 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device.
A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification.
This issue affects Junos OS:
* 24.4 versions before 24.4R2-S4; * 25.2 versions before 25.2R2-S1; * 25.4 versions before 25.4R1-S3;
This issue does not affect Junos OS releases before 24.4R1.
Weakness: CWE-78
Which versions are affected by CVE-2026-102079?
How do I fix CVE-2026-102079?
No fix has been published for CVE-2026-102079 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-102079 being exploited?
There is no known exploitation of CVE-2026-102079 in the wild and no public exploit code.
Sources
Also known as GHSA-47j5-pmw7-5p68.