CVE-2026-21904
Full vulnerability record from the local CVENow database.
Description
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the list filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R5 Patch V3.
Severity
MEDIUM
CVSS score
5.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-09 22:16:24.557000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-21904",
"sourceIdentifier": "[email protected]",
"published": "2026-04-09T22:16:24.557",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the \n\nlist filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.\n\nThis issue affects all versions of Junos Space before 24.1R5 Patch V3."
},
{
"lang": "es",
"value": "Una vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web (’Cross-site Scripting’) en Juniper Networks Junos Space permite a un atacante inyectar etiquetas de script en el campo de filtro de lista que, cuando es visitado por otro usuario, permite al atacante ejecutar comandos con los permisos del objetivo, incluyendo un administrador.\n\nEste problema afecta a todas las versiones de Junos Space anteriores a 24.1R5 Parche V3."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Juniper Networks",
"product": "Junos Space",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "24.1R5 Patch V3",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-10T14:14:36.676713Z",
"id": "CVE-2026-21904",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "289CAAE5-882C-4236-BF76-B20F8A7F3014"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA36F3E8-0F58-4635-843C-B3C62FD48682"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CEA96869-72CF-49D2-94E1-4FF8102A29CA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "21DA6F2F-72F5-4D3A-AB4C-2C5D56C615FF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F6CF9AF7-A335-4C05-9F45-08253A521D40"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "87F7E9A7-CA85-4F4D-8F0C-DF0C79A80B93"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "61A323AE-7C8D-49F3-BB47-15DEBAFC86BD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "EAEC058B-C096-455B-9A75-5191E00A367D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A6E79208-AF42-48D9-990C-E2E2E1DE8E1E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "DA5E2C05-12C0-48B6-BE84-0A045B2A2B91"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "167749D0-F3B8-48F3-BFC8-37A531E48C16"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:12.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D4C754E5-ACBB-45DE-B983-0888A8EB7CD3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:12.3:*:*:*:*:*:*:*",
"matchCriteriaId": "84E7CE7F-4410-461D-9381-B186789B6509"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.1:-:*:*:*:*:*:*",
"matchCriteriaId": "5BE1AAAA-0C4E-4059-96E7-4D118BF2DBEF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.1:r1.8:*:*:*:*:*:*",
"matchCriteriaId": "04858E4C-720A-400E-81AF-B5572424B351"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1:*:*:*:*:*:*",
"matchCriteriaId": "7B610137-66AC-43D3-BBAE-4390011C20AC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.1:*:*:*:*:*:*",
"matchCriteriaId": "53C917DF-0507-45C8-89FE-29F400C35030"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.2:*:*:*:*:*:*",
"matchCriteriaId": "677B0C4D-923A-4376-85A8-56208E3728A3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.3:*:*:*:*:*:*",
"matchCriteriaId": "BDEF52F5-ABE3-453C-9A5C-7FD5CCC18F09"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.4:*:*:*:*:*:*",
"matchCriteriaId": "1B7BBF07-791C-43FE-AC38-EB68493092BC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.5:*:*:*:*:*:*",
"matchCriteriaId": "D5B55D33-A294-4DE2-887D-6A7E29F7EEE8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.6:*:*:*:*:*:*",
"matchCriteriaId": "8DA50B20-F26E-4FB7-A46A-74836CF546A0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.7:*:*:*:*:*:*",
"matchCriteriaId": "2BA008EC-659A-43CC-9741-E765958BD824"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.8:*:*:*:*:*:*",
"matchCriteriaId": "FB63AB30-45A0-40A3-8C45-1BBAA501B2A4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r1.9:*:*:*:*:*:*",
"matchCriteriaId": "31B0594A-AA98-4C17-9646-9DF7620089A5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r2:*:*:*:*:*:*",
"matchCriteriaId": "D81E5484-5C0D-44CB-90A8-65EE4E7D4F92"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r3:*:*:*:*:*:*",
"matchCriteriaId": "5EDD9296-6FB1-45E2-80EE-9F0F84CAFC94"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:13.3:r4:*:*:*:*:*:*",
"matchCriteriaId": "A53A9542-72FD-40E8-94F1-C7C0D776D726"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:14.1:-:*:*:*:*:*:*",
"matchCriteriaId": "DC29AA1D-4CBC-413A-9333-72F3616CE918"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:14.1:r1:*:*:*:*:*:*",
"matchCriteriaId": "00FCCF10-B612-46FC-94E6-70082F2E1091"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:14.1:r2:*:*:*:*:*:*",
"matchCriteriaId": "E5F85CA0-36F3-48EE-8D35-A986412C91D9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:14.1:r3:*:*:*:*:*:*",
"matchCriteriaId": "61813043-BAED-4803-9D5B-7B7E113D2FBD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:15.1:-:*:*:*:*:*:*",
"matchCriteriaId": "E0D618D6-F413-47DD-BD26-4F62B7227A7F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:15.1:r2:*:*:*:*:*:*",
"matchCriteriaId": "B5A79F3A-80B9-4D98-92EE-681ED2E716B8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:15.1:r3:*:*:*:*:*:*",
"matchCriteriaId": "FD833CE8-F37B-4EEB-9DD3-E8A8BB121390"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:15.1:r4:*:*:*:*:*:*",
"matchCriteriaId": "3E4B00D0-93F9-4145-BA91-6F4A66F19854"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:15.2:-:*:*:*:*:*:*",
"matchCriteriaId": "74CB3FCB-192A-48A7-9FF3-3D228729AC60"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:15.2:r2:*:*:*:*:*:*",
"matchCriteriaId": "139FA36E-582D-41E9-AC4F-9BD49C844039"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:16.1:*:*:*:*:*:*:*",
"matchCriteriaId": "67829EE9-39AE-43C5-91FE-A911F5C99346"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:16.1:-:*:*:*:*:*:*",
"matchCriteriaId": "2EB54773-A54F-4D9E-B213-464421B4FA88"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:16.1:r1:*:*:*:*:*:*",
"matchCriteriaId": "FC8CBF0A-310F-41EB-B377-F08FE03E3867"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:16.1:r2:*:*:*:*:*:*",
"matchCriteriaId": "62BB74B8-C90B-4CA1-B8CE-29F8D42D4B46"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:16.1:r3:*:*:*:*:*:*",
"matchCriteriaId": "44855E13-5493-4362-B7E8-5A1A6F299FFC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:16.1r3:*:*:*:*:*:*:*",
"matchCriteriaId": "FC82CE95-E9A7-4B1E-9DEE-FFF24EED713E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:17.1:-:*:*:*:*:*:*",
"matchCriteriaId": "28D46176-27CE-4EAF-AF83-83F81A798103"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:17.1:r1:*:*:*:*:*:*",
"matchCriteriaId": "430F2EBF-09EB-4F48-ACF8-8B4EDF83E284"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:17.2:-:*:*:*:*:*:*",
"matchCriteriaId": "F3EAC6FC-A2DC-4EF1-BF56-93728A9CDDAA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:17.2:r1.4:*:*:*:*:*:*",
"matchCriteriaId": "BE35151C-FCF6-4A89-8283-B24225019241"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:18.1:-:*:*:*:*:*:*",
"matchCriteriaId": "041D10A1-B577-4109-A98D-DA20560FDA37"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:18.1r1:*:*:*:*:*:*:*",
"matchCriteriaId": "D82DF30A-C838-49AC-95DC-16D765FD5588"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:18.2:-:*:*:*:*:*:*",
"matchCriteriaId": "3FD83E88-0DD9-4584-B594-2839D15FA055"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:18.3:-:*:*:*:*:*:*",
"matchCriteriaId": "5F1FA208-9AC5-414A-917A-6595917440EC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:18.4:-:*:*:*:*:*:*",
"matchCriteriaId": "746F17A3-C20A-495D-9EEA-635392ECE907"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:19.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F113B1F6-CF32-4BB4-A3C5-638D1531FE9F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:20.3:r1:*:*:*:*:*:*",
"matchCriteriaId": "326E02EB-2D43-4784-AF77-EAF364AFCA44"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:21.1:r1:*:*:*:*:*:*",
"matchCriteriaId": "395C3952-0DD2-414E-BD71-34C636A60411"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:21.2:r1:*:*:*:*:*:*",
"matchCriteriaId": "CAAD4A16-885D-403B-B7F0-D505F16117E1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:21.3:r1:*:*:*:*:*:*",
"matchCriteriaId": "4E35AACE-C693-4813-8A4C-84AF5CE31598"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:22.1:r1:*:*:*:*:*:*",
"matchCriteriaId": "2A299BD3-E911-4B33-A759-088DADC0CF5C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:22.2:r1:*:*:*:*:*:*",
"matchCriteriaId": "022F09D3-1F23-459B-BA76-14FABB2CB2E6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:22.3:r1:*:*:*:*:*:*",
"matchCriteriaId": "4679BFE4-F00C-4CA2-B7F5-93DC97C13A76"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:23.1:r1:*:*:*:*:*:*",
"matchCriteriaId": "2B4163AD-07D3-4C60-9277-0ACCFBD24255"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:24.1:r1:*:*:*:*:*:*",
"matchCriteriaId": "0566970C-0E9B-4566-9920-C7C436A4243D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:24.1:r2:*:*:*:*:*:*",
"matchCriteriaId": "A2AA399D-5A7D-45B8-B774-D69054DFA4D3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:24.1:r3:*:*:*:*:*:*",
"matchCriteriaId": "57CC4E1A-23AA-4B4A-8690-5EEDCBEC4BBE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:24.1:r4:*:*:*:*:*:*",
"matchCriteriaId": "3F39EC68-9DBB-4A30-BB44-1A26020079CB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:juniper:junos_space:24.1:r5:*:*:*:*:*:*",
"matchCriteriaId": "18B71350-88B1-4644-8CDD-D31661A848F0"
}
]
}
]
}
],
"references": [
{
"url": "https://kb.juniper.net/JSA106003",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}