Quick Look: CVE-2026-21916 — Junos OS Local Privilege Escalation via Symlink Following in the CLI

Introduction

A symlink-following flaw in the Juniper Networks Junos OS CLI lets a low-privileged local user set up the conditions for root access. The escalation itself is triggered by a second user who commits a routine configuration change without knowing it. The vulnerability is tracked as CVE-2026-21916. Juniper is the second-largest vendor in core routers (25% market share) and enterprise firewalls (24.8%), so this flaw could affect a large number of production network environments worldwide.

Technical Information

CVE-2026-21916 is classified under CWE-61: UNIX Symbolic Link (Symlink) Following. The root cause is in how the Junos OS CLI handles the file link operation and how the system resolves symbolic links during configuration commits.

Root Cause

The Junos OS CLI has a file link command that lets users create symbolic links on the filesystem. When any user runs a commit, the commit process resolves symbolic links created by other users in a privileged context. The resolution inherits elevated (root) privileges instead of being limited to the permissions of the user who created the link. It is a classic symlink-following flaw. A low-privileged user creates a symlink pointing to a sensitive location, and a privileged process (the commit handler) follows it without checking that the user who created it was authorized.

Attack Flow

Exploiting CVE-2026-21916 takes a specific multi-step sequence involving two different users:

1. A local, authenticated attacker with low privileges logs into the Junos OS CLI and runs a specific file link ... command, which creates a symbolic link on the filesystem. The attacker chooses the link's target to enable the privilege escalation.

2. The attacker takes no further action and waits for any other authenticated user on the same system to commit a configuration change. That commit can be entirely unrelated to the attacker's symlink.

3. When the second user commits their changes, the Junos OS commit process follows the attacker's symbolic link in a privileged (root) context. Resolving the link with elevated permissions changes the system state so that the original attacker gains root access.

4. Once the commit completes, the low-privileged attacker can log in as root, and the system is fully compromised.

The attack needs a second user, but the attacker does not have to compromise or coordinate with that user. A shared environment where configuration commits happen routinely is enough, and that describes most operational network teams.

CVSS Scoring

The vulnerability has scores under three CVSS standards:

The local access vector and the need for a second account to act lower the exploitability subscore, but confidentiality, integrity, and availability impact are all rated High. Tenable's VPR score puts the risk higher still, at 8.4 (High).

Patch Information

Juniper Networks fixed CVE-2026-21916 in firmware-level patches released on April 8, 2026, as part of its quarterly security bulletin cycle. The fix is documented in Juniper Security Advisory JSA107807 and tracked internally as PR1865633.

With the patch, symlink resolution during a commit no longer inherits or escalates privileges beyond those of the user who created the link. That removes the CWE-61 root cause.

Juniper released fixes for these supported Junos OS release trains:

In each train, every version before the fixed release is vulnerable. So are legacy branches that have reached End of Engineering (EOE) or End of Life (EOL), which Juniper does not evaluate or patch. Organizations running those older branches should make upgrading to a supported, patched train a priority.

The 25.4 release train was never affected, which suggests the vulnerable code path had already been refactored or redesigned in that branch before the flaw was found. Organizations deciding whether to move to a newer major release can weigh that.

As a temporary workaround where an immediate software upgrade is not feasible, Juniper recommends access controls that stop users from performing file link operations on the CLI. This removes the first condition the exploit chain needs. It is only a stopgap, and the definitive fix is one of the patched Junos OS releases listed above.

Detection Methods

Nessus Plugin

The most readily available verified detection method is the Tenable Nessus plugin (ID 305598), released on April 8, 2026, in the "Junos Local Security Checks" family. The plugin is contained in the file juniper_jsa107807.nasl and runs a version-based check, comparing the device's self-reported Junos OS version with the fixed releases listed in advisory JSA107807. It reads the Host/Juniper/JUNOS/Version KB item, so it requires authenticated access to the device. Tenable has assigned it a VPR score of 8.4 (High). Organizations using Tenable Nessus or Tenable.io can deploy the plugin immediately to scan their network infrastructure for vulnerable installations.

Network- and Host-Level Detection

No public YARA rules, Sigma rules, Snort/Suricata IDS signatures, or specific network-level IoCs have been published for CVE-2026-21916 so far. That is expected. The disclosure is recent, and the attack is a local privilege escalation rather than a network-exploitable vulnerability, so traditional network IDS/IPS signatures are less useful here by nature.

Behavioral Monitoring

For host-level detection, security teams should focus monitoring on the steps of the attack chain:

• Monitor Junos OS system logs and audit trails for any use of the file link CLI command, especially by low-privileged users. Treat any unexpected symbolic link creation as a possible sign of an exploitation attempt.
• Track configuration commit events and correlate them with earlier file link operations by different users. The exploit requires symlink creation followed by a commit from another user.
• Watch for unexpected root-level logins, particularly after that sequence of events. A low-privileged account suddenly authenticating as root is a strong indicator of successful exploitation.
• Use the show system audit root-only command on Junos OS devices to capture filesystem state and MD5 checksums. Save a baseline and compare it with the current state periodically to detect unauthorized file modifications or suspicious symbolic links that may indicate compromise.

Manual Version Verification

To assess exposure proactively, check the running Junos OS version against the affected version ranges: all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S3, 24.4 versions before 24.4R2-S2, and 25.2 versions before 25.2R2. Versions 25.4R1 and later are not affected.

Affected Systems and Versions

The vulnerability affects several Junos OS release trains. This table lists the affected and unaffected versions:

The vulnerability affects environments where multiple users share CLI access to the same Junos OS device. That setup is common in network operations centers and managed service provider environments.

Vendor Security History

Juniper Networks has had serious security incidents before. In December 2015, an analysis of Juniper's ScreenOS firmware found a backdoor key using Dual EC DRBG. The unauthorized code let attackers passively decrypt VPN traffic and gain administrative access through a master password. CVE-2026-21916 is an ordinary software vulnerability, not a backdoor, but that history is a reason to audit Juniper products rigorously and deploy their patches promptly.

Because Juniper is the second-largest vendor in core routers and enterprise firewalls, vulnerabilities in Junos OS have an outsized impact on critical infrastructure sectors around the world.

References

• NVD: CVE-2026-21916
• Juniper Security Advisory JSA107807
• Juniper KB: JSA107807
• Tenable CVE Page: CVE-2026-21916
• Tenable Nessus Plugin 305598
• Juniper Documentation: show system audit Command
• Juniper Networks (Wikipedia)