The Junos httpd process exists to answer web management requests. CVE-2026-101983 turns that small service into a pre-authentication path to code execution on Junos OS and Junos OS Evolved devices, and the enabling condition is one configuration construct that many operators enable without thinking about it: a J-Web virtual domain.

Vulnerability overview

CVE-2026-101983 is a stack-based buffer overflow in the httpd process of Juniper Networks Junos OS and Junos OS Evolved. NVD records a CVSS v3.1 base score of 9.8 and a CVSS v4.0 base score of 9.3, published 2026-10-14 as part of the October 2026 Juniper bulletin. The current status is "Awaiting Analysis", so the description reflects the CNA's account rather than a completed independent review.
The vendor description is direct: an unauthenticated network attacker can cause remote code execution and denial of service. The trigger path described is a J-Web virtual-domain configuration.

Mechanism and exploitation conditions

A stack overflow in a network-facing daemon is the classic route from a malformed request to control-flow hijack. The stack holds return addresses and local state; a write past the end of a stack buffer can overwrite both. On modern builds, exploitation depends on what mitigations are compiled in and on what the attacker can learn about the target, but the preconditions here are unusually favourable: no credentials, no prior foothold, and an HTTP request as the delivery mechanism.
The configuration dependency is what distinguishes this CVE from the generic web-daemon overflow. Junos uses J-Web virtual domains to serve different web management content depending on the hostname or address used to reach the device. The vendor names that construct as the trigger, which means a device that has no virtual domains configured does not match the described exploitation path even if J-Web itself is enabled.
For an attacker, the reconnaissance step is therefore twofold: find a reachable HTTP or HTTPS management interface, then determine whether virtual domains are in play. The second question is often answerable from the outside, because virtual-domain routing is visible in how the device responds to different Host headers.
Public sources at the time of writing do not provide exploit code, and there is no claim of exploitation in the wild. CISA's Known Exploited Vulnerabilities catalog version 2026.10.23 does not list CVE-2026-101983.

Impact

Code execution inside httpd gives an attacker a foothold on the routing engine. The daemon does not run with full administrative rights in every respect, but on a device that concentrates management, routing and cryptographic functions, a foothold at that layer is a short step from full control. The denial-of-service outcome is a separate, more immediate risk: repeatedly crashing httpd removes the management interface and can disrupt automated workflows that depend on it.
A network that manages hundreds of devices through a web console should treat the denial-of-service path alone as an availability incident, not a nuisance.

Affected products and scope

The October 2026 fixed builds cover this CVE alongside its siblings. Junos OS is affected on all versions prior to 23.2R2-S7.7, 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3 and 26.2 before 26.2R1-S2.
Junos OS Evolved is affected on all versions prior to 23.2R2-S7.7-EVO, 23.4 before 23.4R2-S8.11-EVO, 24.2 before 24.2R2-S5.6-EVO, 24.4 before 24.4R2-S5-EVO, 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, 26.2 before 26.2R1-S2-EVO, the 23.4X100-EVO branch, 25.2X100 before 25.2X100-D35-EVO and 25.4X300 before 25.4X300-D40-EVO.

Exposure context

A ZoomEye search for app="Juniper" returned 343,949 assets. The figure describes Juniper product exposure on the public internet and is useful for arguing that these platforms are routinely scanned. It does not indicate how many devices answer on HTTP or HTTPS management ports, and it does not indicate virtual-domain configuration. Those two facts have to come from the operator's own inventory.

Remediation and validation

Upgrade to the fixed build for the deployed branch, and treat removal of virtual-domain configuration as a compensating step only where the upgrade cannot happen immediately. Disabling J-Web entirely, where it is not needed, removes the attack path regardless of configuration detail.
Validation should include confirming the running release on all routing engines, checking whether virtual domains remain configured after the upgrade, and reviewing httpd-related logs for crashes or unusual request patterns during the exposure window. Where the device was reachable and unpatched, an integrity review of the configuration is warranted.

References

  • Juniper security bulletin, October 2026: https://supportportal.juniper.net/s/article/2026-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Multiple-vulnerabilities-resolved

  • NVD record for CVE-2026-101983: https://nvd.nist.gov/vuln/detail/CVE-2026-101983

  • NVD record for CVE-2026-101954: https://nvd.nist.gov/vuln/detail/CVE-2026-101954

  • CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog