Juniper PTX Routers Patched Against Root RCE Vulnerability CVE-2026-21902

Juniper Networks released emergency patches for CVE-2026-21902 in Junos OS Evolved 25.4 on PTX Series routers. Unauthenticated attackers could execute root-level code through the exposed On-Box Anomaly detection service. The flaw affects only PTX platforms with default settings enabled.

The vulnerability exposes a critical service meant for internal use only. External traffic reaches it due to wrong permission settings. No user interaction or authentication needed. Full router takeover becomes possible remotely.

Juniper discovered the issue during internal testing. No wild exploitation shows yet. Still network backbone devices demand immediate action. ISPs and enterprises run PTX routers at core locations.

Technical Breakdown

CVE-2026-21902 hits the anomaly detection framework. Default settings leave it exposed.

Detail	Information
CVE ID	CVE-2026-21902
Type	Root RCE via service exposure
Affected	Junos OS Evolved 25.4 PTX Series
CVSS Score	Critical (9.8 estimated)
Vector	Network remote, unauthenticated
Discovery	Juniper internal security testing
Patched Versions	25.4R1-S1-EVO, 25.4R2-EVO, 26.2R1-EVO

Service runs on external port by mistake. Internal routing instance should block access.

Vulnerable Configuration

Attack needs no special setup. Default install exposes the service:

• On-Box Anomaly detection enabled
• No authentication on management port
• External traffic reaches internal service

Standard Junos OS stays safe. Only Evolved 25.4 on PTX hits.

Fix Options

Juniper provides three mitigation paths:

Immediate Patches:

25.4R1-S1-EVO
25.4R2-EVO  
26.2R1-EVO

Temporary Workarounds:
request pfe anomalies disable
Disables vulnerable service instantly.

Network Filters:

• Firewall filters block anomaly port
• Access lists limit trusted IPs only
• Apply to external interfaces

Reboot required after firmware upgrade. Verify patch loaded correctly.

Enterprise Impact

Core routers handle massive traffic. Compromise disrupts:

• ISP backbone connectivity
• Enterprise WAN links
• Data center switching

Root access enables traffic interception, DoS, or persistent footholds. Patch core infrastructure first.

Immediate Actions

Network teams act now:

• Identify PTX devices running Junos Evolved 25.4
• Check show version output immediately
• Apply request pfe anomalies disable tonight
• Schedule firmware upgrades for maintenance window
• Deploy firewall filters on external interfaces

Test connectivity after changes. Monitor logs for exploit attempts.

FAQ