Why the Junos October 2026 Flaws Matter Even Without a CISA KEV Entry

CISA's Known Exploited Vulnerabilities catalog is a good prioritisation input and a poor excuse. Nine Junos vulnerabilities were published on 2026-10-14 at CVSS v3.1 9.8, and as of catalog version 2026.10.23 none of them appears in it. That absence says something about observed exploitation, and nothing about what an attacker with the right network position can do.

Vulnerability overview

The set spans four surfaces. Pre-authentication web: CVE-2026-101954 in J-Web and NETCONF session handling, CVE-2026-101986 in J-Web CGI execution, and CVE-2026-101983 in httpd. Pre-authentication service layer: CVE-2026-102175 in the sdxd service-deployment daemon.…