Juniper Junos OS, Junos Space: Mehrere Schwachstellen
WID-SEC-2026-0117 · first 15.01.2026 · updated 16.01.2026 · CVSS 8,6
What it is about
JUNOS ist das "Juniper Network Operating System", das in Juniper Appliances verwendet wird. Junos Space ist eine Software-Plattform, die eine Reihe von Applikationen für das Netzwerkmanagement beinhaltet. Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS und Juniper Junos Space ausnutzen, um falsche Informationen darzustellen, beliebigen Code mit Root-Rechten auszuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand zu verursachen.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- falsche Informationen darzustellen
- beliebigen Code mit Root-Rechten auszuführen
- Daten zu manipulieren
- vertrauliche Informationen offenzulegen
- einen Denial-of-Service-Zustand zu verursachen
Am I affected?
Affected according to the BSI:
- Juniper JUNOS Paragon Automation (Pathfinder, Planner, Insights) <24.1.1
- Juniper JUNOS OS SRX Series
- Juniper JUNOS OS
- Juniper JUNOS OS Evolved
- Juniper JUNOS OS EX4000
- Juniper JUNOS OS EX4k Series
- Juniper JUNOS OS QFX5k
- Juniper JUNOS OS MX10k Series
- Juniper JUNOS OS SRX and MX Series
- Juniper JUNOS OS MX Series with MX-SPC3
- Juniper JUNOS OS MX Series with MS-MPC
- Juniper Junos Space <24.1R5
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Juniper JUNOS Paragon Automation (Pathfinder, Planner, Insights) 24.1.1
- Juniper Junos Space 24.1R5
Is the vulnerability already being exploited?
- CVE-2024-50302: exploited in the wild according to CISA, in the catalogue since 04.03.2025.
Information and sources
- Original BSI advisory (WID)
- Juniper Patchday vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
- Juniper Security Advisories vom 2026-01-14 supportportal.juniper.net
CVE: CVE-2025-52987, CVE-2026-21907, CVE-2025-60007, CVE-2026-0203, CVE-2026-21903, CVE-2026-21906, CVE-2026-21914, CVE-2026-21917, CVE-2026-21920, CVE-2025-59959, CVE-2025-59960, CVE-2025-59961, CVE-2025-60003, CVE-2025-60011, CVE-2026-21908, CVE-2026-21909, CVE-2026-21921, CVE-2024-50302, CVE-2026-21911, CVE-2026-21913 …
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.