An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device.

A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification.

This issue affects Junos OS:

• 24.4 versions before 24.4R2-S4;
• 25.2 versions before 25.2R2-S1;
• 25.4 versions before 25.4R1-S3;

This issue does not affect Junos OS releases before 24.4R1.


Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was found during internal product security testing or research.

This issue has been assigned CVE-2026-102079.

The following software releases have been updated to resolve this specific issue: Junos OS: 24.4R2-S4, 25.2R2-S1, 25.4R1-S3, 26.2R1, and all subsequent releases.

This issue is being tracked as 1925031 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Utilize CLI authorization to disallow execution of the 'request csds' commands. Use access lists or firewall filters to limit access to the CLI only from trusted hosts and administrators.

2026-10-14: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team