Two Junos J-Web Authentication Failures Turn the Management Interface Into a Root Backdoor

Among the nine critical Junos OS and Junos OS Evolved vulnerabilities published in October 2026, two are authentication failures in J-Web rather than memory corruption. CVE-2026-101954 and CVE-2026-101986 are easy to skim past because they look similar, but they break different assumptions and produce different attacker outcomes, and both are rated 9.8 on the CVSS v3.1 scale.

Vulnerability overview

CVE-2026-101954 is an improper authentication flaw in the J-Web management interface and its NETCONF session handling.…