CVE-2026-21902: Junos OS Evolved Privilege Escalation Flaw

CVE-2026-21902 Overview

CVE-2026-21902 is an Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series devices. The On-Box Anomaly detection framework should only be reachable by internal processes over the internal routing instance. The service is instead exposed on an externally reachable port, allowing an unauthenticated, network-based attacker to manipulate it and execute code as root. The service is enabled by default and requires no specific configuration to be exploitable.

Critical Impact

An unauthenticated remote attacker can take complete control of affected PTX Series routers by executing arbitrary code as root through the exposed On-Box Anomaly detection framework.

Affected Products

• Juniper Junos OS Evolved 25.4 versions before 25.4R1-S1-EVO and 25.4R2-EVO
• PTX Series platforms: PTX10001-36MR, PTX10002-36QDD, PTX10003, PTX10004, PTX10008, PTX10016
• Note: Junos OS Evolved versions before 25.4R1-EVO and classic Junos OS are not affected

Discovery Timeline

• 2026-02-25 - CVE-2026-21902 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-21902

Vulnerability Analysis

The vulnerability stems from an incorrect permission assignment in the On-Box Anomaly detection framework shipped with Junos OS Evolved on PTX Series routers. The framework is designed as an internal telemetry and analytics service that exchanges data between cooperating processes inside the routing engine. By design, this communication channel should be bound to the internal routing instance and remain unreachable from external network interfaces.

On affected releases, the service binds to a network-accessible port without enforcing access restrictions. Any attacker that can reach the device over the network can interact with the framework directly. Once connected, the attacker can manipulate the service to execute code in the context of the root user, providing full control over the device, its routing tables, and any traffic transiting the router.

Because PTX Series routers serve as high-capacity backbone and peering platforms, compromise enables traffic interception, route manipulation, and persistent footholds deep in the service provider or enterprise core.

Root Cause

The root cause is an incorrect permission and exposure configuration on the On-Box Anomaly detection service [CWE-732]. The service inherits no authentication requirement because it was designed for trusted, internal inter-process communication, yet it is reachable on an externally exposed port. The combination of missing authentication and external reachability allows direct interaction with a root-privileged service.

Attack Vector

The attack vector is network-based and requires no authentication, no user interaction, and no special privileges. An attacker sends crafted requests to the exposed On-Box Anomaly detection service over the network. Successful exploitation yields arbitrary code execution as root. A public proof-of-concept script is available in the watchTowr Labs repository, which demonstrates the exploitation flow against vulnerable PTX devices.

Detection Methods for CVE-2026-21902

Indicators of Compromise

• Unexpected inbound connections to the On-Box Anomaly detection service port from non-management or untrusted source addresses.
• New or unexplained processes running as root on PTX routing engines, particularly child processes spawned by the anomaly detection daemon.
• Modifications to system configuration, user accounts, or routing policy that do not correlate with authorized change windows.
• Outbound connections from the routing engine to external IP addresses not associated with normal device operation.

Detection Strategies

• Inspect netstat/socket listings on PTX devices to verify which interfaces and ports the anomaly detection framework binds to and flag any external exposure.
• Compare device firmware versions against the fixed releases (25.4R1-S1-EVO, 25.4R2-EVO) using configuration management tooling.
• Monitor syslog and Junos OS Evolved audit logs for unusual process launches, shell sessions, or commit events without an associated authenticated user.

Monitoring Recommendations

• Capture and centralize syslog, NETCONF, and audit telemetry from all PTX Series devices into a SIEM for correlation against known IoCs.
• Alert on any TCP connection attempts to the anomaly detection service originating outside the management network.
• Track integrity of system binaries and configuration files between scheduled maintenance windows.

How to Mitigate CVE-2026-21902

Immediate Actions Required

• Upgrade affected PTX Series devices to Junos OS Evolved 25.4R1-S1-EVO, 25.4R2-EVO, or later as published in the Juniper Knowledge Base Advisory JSA107128.
• Restrict network reachability to PTX routing engines using infrastructure ACLs and firewall filters that permit only trusted management subnets.
• Audit PTX devices for signs of prior exploitation given the availability of a public proof of concept.

Patch Information

Juniper Networks has released fixed software in Junos OS Evolved 25.4R1-S1-EVO and 25.4R2-EVO. Customers should consult the Juniper Support Portal Advisory for download instructions and platform-specific upgrade guidance. Junos OS Evolved versions before 25.4R1-EVO and classic Junos OS are not affected and do not require this patch.

Workarounds

• Apply loopback firewall filters (lo0 filters) on PTX devices to block external access to the On-Box Anomaly detection service port while permitting legitimate control plane traffic.
• Segment management interfaces into dedicated out-of-band networks unreachable from production data paths.
• Limit BGP and peering interfaces with strict ACLs that drop traffic destined to the routing engine from untrusted sources.

# Example loopback filter concept to restrict routing engine access
# Consult Juniper documentation for production deployment
set firewall family inet filter PROTECT-RE term TRUSTED-MGMT from source-address 198.51.100.0/24
set firewall family inet filter PROTECT-RE term TRUSTED-MGMT then accept
set firewall family inet filter PROTECT-RE term DEFAULT-DENY then discard
set interfaces lo0 unit 0 family inet filter input PROTECT-RE