Unauthenticated Root RCE in Juniper Junos OS Evolved PTX On-Box Anomaly Detection
CVE-2026-21902 is an incorrect permission assignment vulnerability in the On-Box Anomaly Detection framework of Juniper Networks Junos OS Evolved on PTX Series devices. The framework is intended to be reachable only by internal processes over the internal routing instance, but on affected releases it is exposed via an externally reachable port. The service is enabled by default, runs as root, and requires no specific configuration to be active. Public technical analysis indicates the exposed framework provides a Python-based REST API for defining commands, DAGs, handlers, and DAG instances; attacker-controlled command syntax can be committed and later executed by the scheduler, resulting in arbitrary command execution as root. Juniper states the issue affects Junos OS Evolved on PTX Series 25.4 versions before 25.4R1-S1-EVO and 25.4R2-EVO. Versions before 25.4R1-EVO are not affected, and standard Junos OS is not affected.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a single Python script plus a README. The script (watchTowr-vs-JunosEvolved-CVE-2026-21902.py) is an unauthenticated network RCE artifact generator for Juniper Junos OS Evolved PTX devices vulnerable to CVE-2026-21902. It targets an HTTP service on the device (default port 8160) and performs a sequence of API calls: (1) cleanup via DELETE of prior objects (command/DAG/DAG-instance), (2) POST /config/command/<name> to create a command of type `RE-SHELL` with attacker-controlled `syntax` (the shell command), (3) POST /config/dag/<name> to create a DAG that runs that command, (4) POST /config/dag-instance/<name> to enable and schedule immediate execution (start=now, delay=0) for a specified platform string, and (5) POST /config/commit to apply changes. It then waits ~30 seconds for the scheduled job to run. Despite being described as a detection script, it actively executes an arbitrary command on the target to validate exploitability.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
75 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical improper permission assignment vulnerability in Junos OS Evolved's On-Box Anomaly Detection framework that can allow unauthenticated attackers to gain root-level code execution and full control of affected Juniper PTX routers.
An incorrect permission assignment vulnerability affecting Juniper Junos OS Evolved on PTX Series devices (as described in the content).
An unauthenticated remote code execution vulnerability in Juniper Junos OS affecting Juniper PTX Series devices.
A critical privilege escalation / remote takeover vulnerability in Juniper Junos OS Evolved (PTX Series) caused by improper permission assignment in the On-Box Anomaly Detection framework, potentially enabling unauthenticated root-level code execution and full device control.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.