CVE-2026-21904
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A Cross-site Scripting (XSS) vulnerability was found in Juniper Networks Junos Space in the list filter field. It allows an attacker to inject malicious script tags that, when visited by another user (including an administrator), execute commands with the target's permissions. All versions before 24.1R5 Patch V3 are affected.
Risk Assessment
An attacker can hijack an administrator session, leading to full compromise of the Junos Space system and managed network devices.
Recommendation
Immediately upgrade Junos Space to version 24.1R5 Patch V3 or later. Until the update, restrict management interface access to trusted IP addresses only.
Other vulnerabilities in Junos Space
See all- CVE-2017-2306High
In Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the administrative web interface can execute code on the device.
- CVE-2017-2305High
In Junos Space versions prior to 16.1R1, there is a vulnerability due to insufficient authorization checks that allows readonly users on the administrative web interface to create privileged users, enabling privilege escalation.
- CVE-2016-4929High
CVE-2016-4929 in Junos Space before version 15.2R2 contains a vulnerability that allows attackers to execute arbitrary code as a root user.
- CVE-2016-4928High
CVE-2016-4928 is a cross-site request forgery vulnerability in Junos Space before version 15.2R2 that allows remote attackers to perform certain administrative actions.
- CVE-2016-4927High
Insufficient validation of SSH keys in Junos Space before version 15.2R2 allows man-in-the-middle (MITM) type attacks while a Space device is communicating with managed devices.
- CVE-2016-1265Critical
CVE-2016-1265 allows a remote unauthenticated attacker with access to Junos Space to execute arbitrary code or gain access to devices managed by Junos Space. It exploits attack vectors such as CSRF, default authentication credentials, information leak, and command injection.
- CVE-2016-4926Critical
CVE-2016-4926 describes an insufficient authentication vulnerability in Junos Space before version 15.2R2, allowing remote users with access to the Junos Space web interface to perform certain administrative tasks without authentication.
Original NVD description (English source)
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the list filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R5 Patch V3.