CVE-2026-102031

Summary

A low-privileged TACACS+ user can execute arbitrary OS commands with root privileges through a command injection flaw in Juniper's TACACS implementation when periodic authorization refresh is enabled. This allows attackers to gain full system control without needing elevated credentials.

Exploitability

Exploitation is relatively straightforward for authenticated TACACS+ users, requiring only the ability to trigger periodic authorization refresh with crafted input that gets executed as root commands.

Blast radius

The vulnerability affects all Juniper devices running Junos OS Evolved with periodic TACACS+ authorization refresh enabled, potentially allowing attackers to compromise entire network infrastructures with a single authenticated session.

Detection

Monitor for unusual command execution patterns in system logs during TACACS+ authorization refresh intervals, particularly commands that appear to execute with root privileges without explicit user context.

Prioritized remediation

Disable periodic TACACS+ authorization refresh until a patch is available, or upgrade to Junos OS Evolved 23.4R1 or later if available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.