OS Command Injection in Juniper Junos OS Evolved TACACS

A critical OS command injection vulnerability (CVE-2026-102031) has been identified in the TACACS component of Juniper Networks Junos OS Evolved. This vulnerability allows an attacker who has successfully authenticated via TACACS+ to execute arbitrary operating system commands with root privileges. The exploitation vector is contingent on the device having the periodic TACACS+ authorization-refresh feature enabled.

Because this vulnerability bypasses standard privilege restrictions for authenticated users, it represents a significant risk for lateral movement, persistent configuration modification, and full system compromise. Detection and mitigation should focus on identifying unauthorized command execution patterns following the periodic authorization-refresh cycle and applying the vendor-provided firmware updates immediately.

Impact

The vulnerability carries a CVSS 3.1 base score of 9.8, indicating the potential for full system compromise. If exploited, an attacker gains root-level access to the networking device, which could be used to bypass security policies, intercept or manipulate network traffic, and maintain long-term persistence within the enterprise network infrastructure.

Recommendation

• Apply the security patches for Junos OS Evolved provided by Juniper Networks to address CVE-2026-102031.
• Audit all devices running Junos OS Evolved to determine if the periodic TACACS+ authorization-refresh feature is enabled.
• Disable the periodic TACACS+ authorization-refresh feature on internet-facing or high-value network equipment as a temporary mitigating control until patches can be deployed.
• Monitor administrative session logs for unusual command execution patterns or unauthorized attempts to leverage the TACACS+ authorization-refresh process.