Juniper Junos OS Evolved Flaw Allows Low-Privilege Users to Gain Root Access

A security flaw in Juniper Networks’ Junos OS Evolved software allows users with limited permissions to run commands as the system administrator. This issue exists in the TACACS+ authentication service when a specific feature called periodic authorization refresh is turned on. System administrators using affected versions must verify their software status immediately. The National Vulnerability Database lists the defect as CVE-2026-102031. It carries a critical severity rating. Two different CVSS scores appear in the record: 9.3 and 9.8. Both scores indicate a severe risk to network security.

In plain English

The vulnerability is a type of command injection. This means an attacker can trick the system into running unauthorized instructions. Normally, a user with a low-privilege account can only perform basic tasks. They cannot change core settings or view sensitive data. However, this flaw breaks that boundary. If the network is configured to regularly check user permissions via TACACS+, the system fails to validate commands properly. An attacker can insert malicious code into these checks. The system then executes that code with full root privileges. This gives the attacker complete control over the device.

The background

Juniper Networks Junos OS Evolved is a network operating system used for managing routers and switches. TACACS+ is a protocol that handles authentication, authorization, and accounting for network devices. It ensures users are who they say they are and only access what they are allowed to see. The periodic authorization refresh feature is designed to re-check these permissions at set intervals. This helps enforce security policies dynamically. However, the implementation of this refresh process contains the command injection flaw. The weakness is classified as CWE-78, which relates to OS command injection.

What changes now

Organizations running Junos OS Evolved must check their current version against the list of affected releases. The flaw exists in versions before 23.2R2-S7.7-EVO. It also affects versions before 23.4R2-S8.11-EVO. Additionally, versions before 24.2R2-S5.6-EVO are vulnerable. Finally, versions before 24.4R2-S5-EVO are at risk. Administrators should upgrade to the specified service releases or later. If an upgrade is not immediately possible, they should review the use of periodic TACACS+ authorization refresh. Disabling this feature may mitigate the risk, though it could impact security policy enforcement. No other fix has been confirmed yet.

Key terms explained

Command injection occurs when an application passes unsafe user input to a system shell. This allows attackers to execute arbitrary commands. Root access is the highest level of privilege on a Unix-like system. It allows full control over files, processes, and configurations. TACACS+ is a network protocol that separates authentication from authorization. This separation allows for granular control over user permissions. Periodic refresh mechanisms re-evaluate these permissions at regular intervals. Teams usually monitor logs for unusual command executions. Check whether your configuration relies on dynamic permission updates.

What to do and how to stay safe: Juniper Networks

• Verify the exact version of Junos OS Evolved running on your network devices against the affected list provided by Juniper.
• Review your TACACS+ configuration to determine if periodic authorization refresh is enabled on any devices.
• Plan an upgrade to the minimum safe service release for your respective software branch as soon as possible.
• Monitor system logs for unexpected command executions or privilege escalations from low-privilege accounts.

Step-by-step guide: Risk-Based Vulnerability Management: Benefits, Limits, and Reality

General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Juniper products are affected by CVE-2026-102031?

The vulnerability affects Juniper Networks Junos OS Evolved in versions prior to 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, and 24.4R2-S5-EVO.

What do I need to do to exploit this flaw?

An attacker needs a low-privileged TACACS+-authenticated user account and must have periodic TACACS+ authorization refresh enabled on the target device.

Is there a patch available for this vulnerability?

Yes, Juniper Networks has released service releases that address this issue. Users must upgrade to at least 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, or 24.4R2-S5-EVO.