CVE-2026-101983: A Stack Overflow in Junos httpd Reaches the Routing Engine Through J-Web

The Junos httpd process exists to answer web management requests. CVE-2026-101983 turns that small service into a pre-authentication path to code execution on Junos OS and Junos OS Evolved devices, and the enabling condition is one configuration construct that many operators enable without thinking about it: a J-Web virtual domain.

Vulnerability overview

CVE-2026-101983 is a stack-based buffer overflow in the httpd process of Juniper Networks Junos OS and Junos OS Evolved. NVD records a CVSS v3.1 base score of 9.8 and a CVSS v4.0 base score of 9.3, published 2026-10-14 as part of the October 2026 Juniper bulletin. The current status is "Awaiting Analysis", so the description reflects the CNA's account rather than a completed independent review.

The vendor description is direct: an unauthenticated network attacker can cause remote code execution and denial of service.…