INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Juniper Patch Vulnerability Exploit Critical Router Takeover

| 2026-02-27 11:40 CRITICAL LOW
JSON
Executive Summary AI-generated
The Juniper Networks vulnerability, CVE-2026-21902, has been identified as a critical remote code execution (RCE) flaw affecting PTX routers. This issue was first reported in January 2025 and is caused by an incorrect permission assignment in the On-Box Anomaly detection framework. The vendor recommends limiting access to the vulnerable service using ACLs or firewall filters to allow only trusted hosts, or disabling the service entirely with a request for pfe anomalies disable as a workaround. Immediate patching is not possible due to the lack of awareness by Juniper's Security Incident Response Team at the time of publishing the security bulletin.
Technical Mitigations AI-generated
* Limit access to the vulnerable service using ACLs or firewall filters, and restrict trusted hosts only. * Disable the vulnerable service entirely with request pfe anomalies disable as a workaround. * Use 'request pfe anomalies disable' Juniper Networks products ar to limit access to the vulnerable endpoints.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
J-magicJ-magic CVE-2026-21902CVE-2026-21902
Target & Sectors
Global Scope energyenergy manufacturingmanufacturing
Incident Timeline
December 2024
Juniper Networks Smart routers were compromised by Mirai botnet in December 2024.
tactic Botnet
In December 2024, Juniper Networks Smart routers became targets of Mirai botnet campaigns, getting enlisted in distributed denial of service (DDoS) swarms.
tactic Ddos
In December 2024, Juniper Networks Smart routers became targets of Mirai botnet campaigns, getting enlisted in distributed denial of service (DDoS) swarms.
organisation Juniper Networks Smart
In December 2024, Juniper Networks Smart routers became targets of Mirai botnet campaigns, getting enlisted in distributed denial of service (DDoS) swarms.
organisation Mirai
In December 2024, Juniper Networks Smart routers became targets of Mirai botnet campaigns, getting enlisted in distributed denial of service (DDoS) swarms.
January 2025
Threat actors used a malware campaign targeting Juniper VPN gateways in the energy, manufacturing, and IT sectors.
industry Energy
In January 2025, a malware campaign dubbed ‘J-magic’ targeted Juniper VPN gateways used in the semiconductor, energy, manufacturing, and IT sectors, deploying network-sniffing malware that activated upon receiving a “magic packet.”
industry Manufacturing
In January 2025, a malware campaign dubbed ‘J-magic’ targeted Juniper VPN gateways used in the semiconductor, energy, manufacturing, and IT sectors, deploying network-sniffing malware that activated upon receiving a “magic packet.”
malware J-magic
In January 2025, a malware campaign dubbed ‘J-magic’ targeted Juniper VPN gateways used in the semiconductor, energy, manufacturing, and IT sectors, deploying network-sniffing malware that activated upon receiving a “magic packet.”
organisation Juniper
In January 2025, a malware campaign dubbed ‘J-magic’ targeted Juniper VPN gateways used in the semiconductor, energy, manufacturing, and IT sectors, deploying network-sniffing malware that activated upon receiving a “magic packet.”
March 2025
Threat actors used a custom backdoor on EoL Junos OS MX routers to deploy TinyShell variants.
tactic Espionage
In March 2025, it was revealed that Chinese cyber-espionage actors were deploying custom backdoors on EoL Junos OS MX routers to drop a set of ‘TinyShell’ backdoor variants.
source_region China
In March 2025, it was revealed that Chinese cyber-espionage actors were deploying custom backdoors on EoL Junos OS MX routers to drop a set of ‘TinyShell’ backdoor variants.
organisation EoL Junos OS MX
In March 2025, it was revealed that Chinese cyber-espionage actors were deploying custom backdoors on EoL Junos OS MX routers to drop a set of ‘TinyShell’ backdoor variants.
organisation TinyShell
In March 2025, it was revealed that Chinese cyber-espionage actors were deploying custom backdoors on EoL Junos OS MX routers to drop a set of ‘TinyShell’ backdoor variants.
February 27, 2026
Threat actors used a Remote Code Execution vulnerability (CVE-2026-21902) in Juniper Networks' PTX routers to gain unauthorized access.
organisation CVE-2026-21902
Juniper issues emergency patch for critical PTX router RCE Pierluigi Paganini February 27, 2026 Juniper released an emergency patch for Junos OS Evolved to fix CVE-2026-21902, a critical RCE flaw affecting PTX routers.
organisation RCE
Juniper issues emergency patch for critical PTX router RCE Pierluigi Paganini February 27, 2026 Juniper released an emergency patch for Junos OS Evolved to fix CVE-2026-21902, a critical RCE flaw affecting PTX routers.
infrastructure 9.3
Juniper Networks issued an out-of-band security update for Junos OS Evolved to address a critical remote code execution vulnerability, tracked as CVE-2026-21902 (CVSS score of 9.3), impacting PTX routers.
organisation Juniper Networks
Juniper Networks issued an out-of-band security update for Junos OS Evolved to address a critical remote code execution vulnerability, tracked as CVE-2026-21902 (CVSS score of 9.3), impacting PTX routers.
organisation Juniper Networks Junos OS
“An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root.
organisation ACLs
The vendor recommends limiting access to the vulnerable service using ACLs or firewall filters to allow only trusted hosts, or disabling the service entirely with request pfe anomalies disable as a workaround.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, RCE)
2026-02-27
Juniper's Security Incident Response Team found a critical vulnerability in Junos OS Evolved that allowed an attacker to execute code remotely with root privileges.
organisation CVE-2026-21902
Junos OS versions are not impacted by CVE-2026-21902.
organisation Juniper Networks
A critical vulnerability in the Junos OS Evolved network operating system running on PTX Series routers from Juniper Networks could allow an unauthenticated attacker to execute code remotely with root privileges.
organisation Versions
Versions before 25.4R1-EVO, and standard (non-Evolved)
organisation Juniper's
Juniper's Security Incident Response Team (SIRT) states that it was not aware of malicious exploitation of the vulnerability at the time of publishing the security bulletin.
organisation Security Incident Response Team
Juniper's Security Incident Response Team (SIRT) states that it was not aware of malicious exploitation of the vulnerability at the time of publishing the security bulletin.
organisation Access Control Lists
If immediate patching is not possible, the vendor's recommendation is to restrict access to the vulnerable endpoints to trusted networks only using firewall filters or Access Control Lists (ACLs).
organisation Modern
Modern IT infrastructure moves faster than manual workflows can handle.
organisation Tines
In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.
Tactical Metrics
Metrics
infrastructure
​9.3
Software Version
Juniper Networks issued an out-of-band security update for Junos OS Evolved to address a critical remote code execution vulnerability, tracked as CVE-2026-21902 (CVSS score of 9.3), impacting PTX routers.
Intelligence Sources
Security Affairs 2026-02-27
BleepingComputer 2026-02-26