CVE-2026-21916 (GCVE-0-2026-21916)

Vulnerability from cvelistv5 – Published: 2026-04-09 21:28 – Updated: 2026-04-13 13:04
VLAI
Title
Junos OS: A low privileged user can escalate their privileges so that they can login as root
Summary
A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system. When after a user has performed a specific 'file link ...' CLI operation, another user commits (unrelated configuration changes), the first user can login as root. This issue affects Junos OS: * all versions before 23.2R2-S7, * 23.4 versions before 23.4R2-S6, * 24.2 versions before 24.2R2-S3, * 24.4 versions before 24.4R2-S2, * 25.2 versions before 25.2R2. This issue does not affect versions 25.4R1 or later.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
7 (High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:M
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-10 03:56 UTC
CWE
  • CWE-61 - UNIX Symbolic Link (Symlink) Following
Assigner
References
URL Tags
https://kb.juniper.net/JSA107807 vendor-advisory
Impacted products
Vendor Product Version CPE status
Juniper Networks Junos OS Affected: 0 , < 23.2R2-S7 (semver)
Affected: 23.4 , < 23.4R2-S6 (semver)
Affected: 24.2 , < 24.2R2-S3 (semver)
Affected: 24.4 , < 24.4R2-S2 (semver)
Affected: 25.2 , < 25.2R2 (semver)
Unaffected: 25.4R1
guessed Create a notification for this product.
Date Public
2026-04-08 16:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21916",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-10T03:56:11.604149Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-13T13:04:16.395Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "23.2R2-S7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "23.4R2-S6",
              "status": "affected",
              "version": "23.4",
              "versionType": "semver"
            },
            {
              "lessThan": "24.2R2-S3",
              "status": "affected",
              "version": "24.2",
              "versionType": "semver"
            },
            {
              "lessThan": "24.4R2-S2",
              "status": "affected",
              "version": "24.4",
              "versionType": "semver"
            },
            {
              "lessThan": "25.2R2",
              "status": "affected",
              "version": "25.2",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "25.4R1"
            }
          ]
        }
      ],
      "datePublic": "2026-04-08T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system.\u003cbr\u003e\u003cbr\u003eWhen after a user has performed a specific \u0027file link ...\u0027 CLI operation, another user commits (unrelated configuration changes), the first user can login as root.\u003cbr\u003e\u003cbr\u003eThis issue affects Junos OS:\u003cbr\u003e\u003cul\u003e\u003cli\u003eall versions before 23.2R2-S7,\u003c/li\u003e\u003cli\u003e23.4 versions before 23.4R2-S6,\u003c/li\u003e\u003cli\u003e24.2 versions before 24.2R2-S3,\u003c/li\u003e\u003cli\u003e24.4 versions before 24.4R2-S2,\u003c/li\u003e\u003cli\u003e25.2 versions before 25.2R2.\u003c/li\u003e\u003c/ul\u003eThis issue does not affect versions 25.4R1 or later."
            }
          ],
          "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system.\n\nWhen after a user has performed a specific \u0027file link ...\u0027 CLI operation, another user commits (unrelated configuration changes), the first user can login as root.\n\nThis issue affects Junos OS:\n  *  all versions before 23.2R2-S7,\n  *  23.4 versions before 23.4R2-S6,\n  *  24.2 versions before 24.2R2-S3,\n  *  24.4 versions before 24.4R2-S2,\n  *  25.2 versions before 25.2R2.\n\n\nThis issue does not affect versions 25.4R1 or later."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
            }
          ],
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "USER",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:M",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "CWE-61 UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-09T21:28:05.552Z",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://kb.juniper.net/JSA107807"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The following software releases have been updated to resolve this specific issue: 23.2R2-S7, 23.4R2-S6, 24.2R2-S3, 24.4R2-S2, 25.2R2, and all subsequent releases.\u003cbr\u003e"
            }
          ],
          "value": "The following software releases have been updated to resolve this specific issue: 23.2R2-S7, 23.4R2-S6, 24.2R2-S3, 24.4R2-S2, 25.2R2, and all subsequent releases."
        }
      ],
      "source": {
        "advisory": "JSA107807",
        "defect": [
          "1865633"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Junos OS: A low privileged user can escalate their privileges so that they can login as root",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "To prevent exploitation, use access controls to keep users from performing \u0027file link\u0027 operations."
            }
          ],
          "value": "To prevent exploitation, use access controls to keep users from performing \u0027file link\u0027 operations."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2026-21916",
    "datePublished": "2026-04-09T21:28:05.552Z",
    "dateReserved": "2026-01-05T17:32:48.711Z",
    "dateUpdated": "2026-04-13T13:04:16.395Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-21916",
      "date": "2026-09-30",
      "epss": "0.00129",
      "percentile": "0.02136"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Junos OS",
                "vendor": "Juniper Networks",
                "versions": [
                  {
                    "lessThan": "23.2R2-S7",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "23.4R2-S6",
                    "status": "affected",
                    "version": "23.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "24.2R2-S3",
                    "status": "affected",
                    "version": "24.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "24.4R2-S2",
                    "status": "affected",
                    "version": "24.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "25.2R2",
                    "status": "affected",
                    "version": "25.2",
                    "versionType": "semver"
                  },
                  {
                    "status": "unaffected",
                    "version": "25.4R1"
                  }
                ]
              }
            ],
            "source": "sirt@juniper.net"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3D14745F-3090-483F-9DB4-C424FA09BD21",
                    "versionEndExcluding": "23.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*",
                    "matchCriteriaId": "1A78CC80-E8B1-4CDA-BB35-A61833657FA7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "4B3B2FE1-C228-46BE-AC76-70C2687050AE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "F1B16FF0-900F-4AEE-B670-A537139F6909",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "B227E831-30FF-4BE1-B8B2-31829A5610A6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:*",
                    "matchCriteriaId": "1ADA814B-EF98-45B1-AF7A-0C89688F7CA5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "A6FB32DF-D062-4FB9-8777-452978BEC7B7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "B3B6C811-5C10-4486-849D-5559B592350A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s3:*:*:*:*:*:*",
                    "matchCriteriaId": "078D61B9-A228-453C-9D20-6F9C6B20637F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s4:*:*:*:*:*:*",
                    "matchCriteriaId": "F1F136A0-021D-43FE-BDD3-AD7201F7FC03",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s5:*:*:*:*:*:*",
                    "matchCriteriaId": "37147BC9-9ED8-48AE-906A-614AD8600962",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s6:*:*:*:*:*:*",
                    "matchCriteriaId": "7897729C-4128-49E9-B4A1-25353BC4DBB2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*",
                    "matchCriteriaId": "78481ABC-3620-410D-BC78-334657E0BB75",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "BE8A5BA3-87BD-473A-B229-2AAB2C797005",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "8B74AC3E-8FC9-400A-A176-4F7F21F10756",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "CB2D1FCE-8019-4CE1-BA45-D62F91AF7B51",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:*",
                    "matchCriteriaId": "175CCB13-76C0-44A4-A71D-41E22B92EB23",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "166BFDB3-1945-4949-BC2B-E18442FF2E4D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "5923610F-878C-48CA-8B5D-9C609E4DD4DB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s3:*:*:*:*:*:*",
                    "matchCriteriaId": "A7C207E3-0252-4192-8E8C-E2ED2831B4F4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s4:*:*:*:*:*:*",
                    "matchCriteriaId": "E6974492-FE69-4340-8881-61C3329C1545",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s5:*:*:*:*:*:*",
                    "matchCriteriaId": "279E59FE-96DF-4E1D-A3A2-61D180F04533",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:*",
                    "matchCriteriaId": "89524D6D-0B22-4952-AD8E-8072C5A05D5C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "AD69A194-1B03-44EA-8092-79BD10C6F729",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "8463ADB4-B8A7-4D63-97A9-232ED713A21C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:r1-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "FE68337F-106E-4317-A5B6-292B0159F577",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:r2:*:*:*:*:*:*",
                    "matchCriteriaId": "266B520A-482A-43F7-90F8-B9D64D30034F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:r2-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "AC78BC9E-5DA7-4E42-9923-B49A0B7F3564",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.2:r2-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "DD99F1B0-82B0-4CD3-8C8F-C0FFF44A8B90",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*",
                    "matchCriteriaId": "C452BDCB-34E3-42D3-8909-2312356EB70A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "2B8158F2-2028-40E9-955F-CFD581A32F60",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "1A7233A1-EC7A-4458-9AE1-835480A03A21",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:*",
                    "matchCriteriaId": "D74087E2-5CAA-4085-8408-EB70EC1D5D91",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.4:r2:*:*:*:*:*:*",
                    "matchCriteriaId": "0EEF1798-F3C2-4645-96E7-1E82368B184D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:24.4:r2-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "C8BB5EE1-04C7-4DF3-807A-06005ECFEEE5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:25.2:-:*:*:*:*:*:*",
                    "matchCriteriaId": "1B7572BB-9C77-4214-9C5F-CC83C7B93E37",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:25.2:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "CAADBF98-38BE-40E2-AF1B-9077DCED0809",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:25.2:r1-s1:*:*:*:*:*:*",
                    "matchCriteriaId": "558F0A4C-0C72-4BF1-B2DE-C0D3BFD54BCD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:juniper:junos:25.2:r1-s2:*:*:*:*:*:*",
                    "matchCriteriaId": "127FE528-AB27-4B18-AF3B-1BE7C0AEEE20",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system.\n\nWhen after a user has performed a specific \u0027file link ...\u0027 CLI operation, another user commits (unrelated configuration changes), the first user can login as root.\n\nThis issue affects Junos OS:\n  *  all versions before 23.2R2-S7,\n  *  23.4 versions before 23.4R2-S6,\n  *  24.2 versions before 24.2R2-S3,\n  *  24.4 versions before 24.4R2-S2,\n  *  25.2 versions before 25.2R2.\n\n\nThis issue does not affect versions 25.4R1 or later."
          }
        ],
        "id": "CVE-2026-21916",
        "lastModified": "2026-06-17T10:19:09.340",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.3,
              "impactScore": 5.9,
              "source": "sirt@juniper.net",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "YES",
                "Recovery": "USER",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "MODERATE"
              },
              "source": "sirt@juniper.net",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-21916",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-10T03:56:11.604149Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-04-09T22:16:24.953",
        "references": [
          {
            "source": "sirt@juniper.net",
            "tags": [
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://kb.juniper.net/JSA107807"
          }
        ],
        "sourceIdentifier": "sirt@juniper.net",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-61"
              }
            ],
            "source": "sirt@juniper.net",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-04-13T19:22:59+00:00",
      "cve": "CVE-2026-21916",
      "id": "CVE-2026-21916",
      "initial_release_date": "2026-04-08T16:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Junos OS: A low privileged user can escalate their privileges so that they can login as root",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21916.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-21916",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-10T03:56:11.604149Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-13T13:00:23.659Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Junos OS",
              "vendor": "Juniper Networks",
              "versions": [
                {
                  "lessThan": "23.2R2-S7",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "23.4R2-S6",
                  "status": "affected",
                  "version": "23.4",
                  "versionType": "semver"
                },
                {
                  "lessThan": "24.2R2-S3",
                  "status": "affected",
                  "version": "24.2",
                  "versionType": "semver"
                },
                {
                  "lessThan": "24.4R2-S2",
                  "status": "affected",
                  "version": "24.4",
                  "versionType": "semver"
                },
                {
                  "lessThan": "25.2R2",
                  "status": "affected",
                  "version": "25.2",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "25.4R1"
                }
              ]
            }
          ],
          "datePublic": "2026-04-08T16:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system.\u003cbr\u003e\u003cbr\u003eWhen after a user has performed a specific \u0027file link ...\u0027 CLI operation, another user commits (unrelated configuration changes), the first user can login as root.\u003cbr\u003e\u003cbr\u003eThis issue affects Junos OS:\u003cbr\u003e\u003cul\u003e\u003cli\u003eall versions before 23.2R2-S7,\u003c/li\u003e\u003cli\u003e23.4 versions before 23.4R2-S6,\u003c/li\u003e\u003cli\u003e24.2 versions before 24.2R2-S3,\u003c/li\u003e\u003cli\u003e24.4 versions before 24.4R2-S2,\u003c/li\u003e\u003cli\u003e25.2 versions before 25.2R2.\u003c/li\u003e\u003c/ul\u003eThis issue does not affect versions 25.4R1 or later."
                }
              ],
              "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system.\n\nWhen after a user has performed a specific \u0027file link ...\u0027 CLI operation, another user commits (unrelated configuration changes), the first user can login as root.\n\nThis issue affects Junos OS:\n  *  all versions before 23.2R2-S7,\n  *  23.4 versions before 23.4R2-S6,\n  *  24.2 versions before 24.2R2-S3,\n  *  24.4 versions before 24.4R2-S2,\n  *  25.2 versions before 25.2R2.\n\n\nThis issue does not affect versions 25.4R1 or later."
            }
          ],
          "exploits": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
                }
              ],
              "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV4_0": {
                "Automatable": "YES",
                "Recovery": "USER",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 7,
                "baseSeverity": "HIGH",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:M",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "MODERATE"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-61",
                  "description": "CWE-61 UNIX Symbolic Link (Symlink) Following",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-09T21:28:05.552Z",
            "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
            "shortName": "juniper"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://kb.juniper.net/JSA107807"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "The following software releases have been updated to resolve this specific issue: 23.2R2-S7, 23.4R2-S6, 24.2R2-S3, 24.4R2-S2, 25.2R2, and all subsequent releases.\u003cbr\u003e"
                }
              ],
              "value": "The following software releases have been updated to resolve this specific issue: 23.2R2-S7, 23.4R2-S6, 24.2R2-S3, 24.4R2-S2, 25.2R2, and all subsequent releases."
            }
          ],
          "source": {
            "advisory": "JSA107807",
            "defect": [
              "1865633"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Junos OS: A low privileged user can escalate their privileges so that they can login as root",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "To prevent exploitation, use access controls to keep users from performing \u0027file link\u0027 operations."
                }
              ],
              "value": "To prevent exploitation, use access controls to keep users from performing \u0027file link\u0027 operations."
            }
          ],
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "assignerShortName": "juniper",
        "cveId": "CVE-2026-21916",
        "datePublished": "2026-04-09T21:28:05.552Z",
        "dateReserved": "2026-01-05T17:32:48.711Z",
        "dateUpdated": "2026-04-13T13:04:16.395Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.