You know what I love about my mornings? Reading about another critical-severity, unauthenticated remote code execution vulnerability in a piece of network core infrastructure that half the Fortune 500 has sitting in the middle of their backbone. My coffee was almost at a drinkable temperature when the Juniper advisory landed. Almost.

CVE-2026-21902. CVSS 9.3 to 9.8 depending on which scoring source you use. Juniper PTX Series routers. Junos OS Evolved. Unauthenticated. Remote. Root. Those four words together are the cybersecurity equivalent of finding out your house has no locks and someone also took the windows.

Juniper issued an out-of-band emergency patch on February 25–26, 2026. “Out-of-band” means they didn’t wait for a scheduled maintenance window. They pushed a patch on a Friday because the bug is that bad. When a vendor does that, you drop whatever you’re doing and pay attention.

What CVE-2026-21902 Actually Is

Per Juniper’s official security bulletin and analysis from Security Affairs and CSO Online, this vulnerability lives in the On-Box Anomaly Detection framework of Junos OS Evolved on PTX Series routers. The anomaly detection module is enabled by default — so every affected device ships exposed out of the box unless you’ve specifically disabled this component, which most operators haven’t, because why would you disable your anomaly detection?

Here’s the mechanics of how this happened: the On-Box Anomaly Detection service is only supposed to be reachable by internal processes, communicating over the internal routing instance. It should not be accessible externally. But due to an incorrect permission assignment for a critical resource — a fancy way of saying someone gave the wrong access controls to a service port — the service is reachable from outside. Through the network. Without authentication.

And once you reach it without authentication? You can execute code as root. Not as a limited user. As root. Juniper’s advisory puts it plainly: “With the ability to access and manipulate the service to execute code as root, a remote attacker can take complete control of the device.” Complete control. Of a PTX core router. Breathe.

Why PTX Is Not Just Another Device

I want to make sure the business risk here is crystal clear, because “router vulnerability” sounds technical and boring and I have watched executives’ eyes glaze over the moment the word “router” appears in a slide deck.

PTX Series routers are Juniper’s high-performance core routing platform. These are not branch office switches. These are not small office firewalls that some regional manager approved without reading the spec sheet. These are the devices that sit in the spine of large enterprise networks, carrier backbones, and service provider infrastructure. They move massive volumes of traffic between major network segments.

As CSO Online reported, “the vulnerability is especially dangerous because this model sits in the network core, so attackers could intercept or redirect data.” If an attacker compromises a PTX router, they’re not in your branch office in Dortmund. They’re in your network core. They can intercept traffic at scale. They can man-in-the-middle core network flows. They can silently copy or manipulate data crossing the device. And because PTX routers are trusted infrastructure, traffic through them is often not scrutinised the same way east-west endpoint traffic might be. An attacker who lands on a PTX router isn’t running code on one box. They’re sitting on everything connected to it.

How the Hell Does a Default-Enabled Service Have Wrong Permissions

This is the root cause analysis portion where I get theatrical, so bear with me.

The anomaly detection module is default-enabled. That sounds fine — default-enabled security monitoring is conceptually sensible. The problem is that it apparently wasn’t subjected to the same “do not expose this externally” rigour that other internal-only services received during development and QA. The service is documented as communicating only over the internal routing instance. Someone assigned incorrect permissions to the service port. Now it’s reachable externally. This should have been caught in security design review or in network-level penetration testing before the product shipped.

This is not unique to Juniper. I spent time writing about the Cisco SD-WAN CVSS 10.0 zero-day that left enterprise networks open since 2023, and the root cause had identical DNA — critical network management components exposed in ways that weren’t intended, at privilege levels that should have been impossible. And the Fortinet situation — 780 unique IPs brute-forcing Fortinet SSL VPN — same pattern. The trusted perimeter and core network devices are being specifically targeted because attackers have correctly identified them as the highest-value pivot points in any network. A single critical flaw in a core router is worth more than compromising a hundred endpoints.

The broader pattern that nobody in the networking vendor industry wants to acknowledge: they are shipping production hardware with service permission misconfiguration bugs that allow unauthenticated root access. In 2026. And these aren’t being found internally before release — they’re being found post-deployment by researchers or, worst case, by attackers. The IBMx-Force 2026 data I covered — AI turbocharging attackers while your basics still suck — makes this even more uncomfortable. An AI-assisted attacker who discovers CVE-2026-21902 in your environment isn’t spending three days manually pivoting. They have automated tooling that finds the flaw, exploits it, and establishes persistence in minutes.

The Patch Exists — Deploy It

Juniper released patches in Junos OS Evolved versions 25.4 and 26.2. UpGuard confirmed that updates are available. This is one of those situations where the fix exists and the only variable is whether your network team has deployed it.

Here’s what you do right now:

One — inventory every PTX device in your environment running Junos OS Evolved. This is your priority task right now, today.

Two — check firmware versions against Juniper’s security bulletin. Anything not on a patched build of 25.4 or 26.2 is vulnerable.

Three — apply the patch under emergency change procedures. CVSS 9.3+ unauthenticated RCE on core network infrastructure is not something you schedule for next maintenance window.

Four — while patching is being organised, investigate whether disabling the On-Box Anomaly Detection framework is operationally viable. This removes the vulnerable attack surface entirely, though obviously at the cost of that detection capability.

Five — check your management plane exposure. As I’ve been saying for years, publicly visible device IPs are an open invitation to anyone with a scanner. If your Juniper management interface is internet-accessible, that needs to stop today regardless of which CVEs currently exist.

Six — once patched, review your blast radius assumptions. If a PTX router is compromised, what can an attacker reach from there? Does it span your entire network? If yes, that’s an architecture problem that a patch doesn’t fix.

Another day, another “unauthenticated remote code execution as root on core network infrastructure” situation. This time it’s Juniper.

CVE-2026-21902. CVSS 9.3. Affects Juniper PTX Series routers running Junos OS Evolved. The vulnerability lives in the On-Box Anomaly Detection framework — a service that is enabled by default, supposed to communicate only over the internal routing instance, but thanks to an incorrect permission assignment, is reachable from external networks. Without credentials. And if you reach it without credentials, you can execute code as root on the device.

Root. On a PTX Series core router. Not a branch switch. Not a firewall some regional manager approved without reading. A core router in the spine of enterprise and carrier-grade networks.

Juniper pushed an out-of-band emergency patch on February 25–26. When vendors go out-of-band, they’re communicating severity without saying the words. This is that.

If you have PTX Series routers running Junos OS Evolved, you identify them today. You check your firmware versions today. You apply the patch under emergency change procedures if your organisation has any functioning sense of risk. And if patching takes time, you investigate whether disabling the On-Box Anomaly Detection framework is viable as an interim mitigation.

Also: check whether your Juniper management plane is internet-accessible. It shouldn’t be. But on at least one device in your estate, it probably is.

The core network devices you trust the most are exactly what attackers are targeting. This shouldn’t be a surprise by now.

Full breakdown in the article 👇