CVE-2026-21916

Full vulnerability record from the local CVENow database.
Description

A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system. When after a user has performed a specific 'file link ...' CLI operation, another user commits (unrelated configuration changes), the first user can login as root. This issue affects Junos OS: * all versions before 23.2R2-S7, * 23.4 versions before 23.4R2-S6, * 24.2 versions before 24.2R2-S3, * 24.4 versions before 24.4R2-S2, * 25.2 versions before 25.2R2. This issue does not affect versions 25.4R1 or later.
Severity
HIGH
CVSS score
7.0 (v4.0)
Vulnerability status
Analyzed
Source identifier
[email protected]
Published
2026-04-09 22:16:24.953000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
  "id": "CVE-2026-21916",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T22:16:24.953",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system.\n\nWhen after a user has performed a specific 'file link ...' CLI operation, another user commits (unrelated configuration changes), the first user can login as root.\n\nThis issue affects Junos OS:\n  *  all versions before 23.2R2-S7,\n  *  23.4 versions before 23.4R2-S6,\n  *  24.2 versions before 24.2R2-S3,\n  *  24.4 versions before 24.4R2-S2,\n  *  25.2 versions before 25.2R2.\n\n\nThis issue does not affect versions 25.4R1 or later."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de seguimiento de enlace simbólico (Symlink) de UNIX en la CLI de Juniper Networks Junos OS permite a un atacante local, autenticado y con bajos privilegios escalar sus privilegios a root, lo que conducirá a un compromiso completo del sistema.\n\nCuando, después de que un usuario ha realizado una operación CLI específica de ’file link ...’, otro usuario confirma (cambios de configuración no relacionados), el primer usuario puede iniciar sesión como root.\n\nEste problema afecta a Junos OS:\n  *  todas las versiones anteriores a 23.2R2-S7,\n  *  versiones 23.4 anteriores a 23.4R2-S6,\n  *  versiones 24.2 anteriores a 24.2R2-S3,\n  *  versiones 24.4 anteriores a 24.4R2-S2,\n  *  versiones 25.2 anteriores a 25.2R2.\n\nEste problema no afecta a las versiones 25.4R1 o posteriores."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Juniper Networks",
          "product": "Junos OS",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "23.2R2-S7",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "23.4",
              "lessThan": "23.4R2-S6",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "24.2",
              "lessThan": "24.2R2-S3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "24.4",
              "lessThan": "24.4R2-S2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "25.2",
              "lessThan": "25.2R2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "25.4R1",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "LOW",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "YES",
          "Recovery": "USER",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-10T03:56:11.604149Z",
          "id": "CVE-2026-21916",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-61"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "23.2",
              "matchCriteriaId": "3D14745F-3090-483F-9DB4-C424FA09BD21"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "1A78CC80-E8B1-4CDA-BB35-A61833657FA7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*",
              "matchCriteriaId": "4B3B2FE1-C228-46BE-AC76-70C2687050AE"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*",
              "matchCriteriaId": "F1B16FF0-900F-4AEE-B670-A537139F6909"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*",
              "matchCriteriaId": "B227E831-30FF-4BE1-B8B2-31829A5610A6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:*",
              "matchCriteriaId": "1ADA814B-EF98-45B1-AF7A-0C89688F7CA5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:*",
              "matchCriteriaId": "A6FB32DF-D062-4FB9-8777-452978BEC7B7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:*",
              "matchCriteriaId": "B3B6C811-5C10-4486-849D-5559B592350A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s3:*:*:*:*:*:*",
              "matchCriteriaId": "078D61B9-A228-453C-9D20-6F9C6B20637F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s4:*:*:*:*:*:*",
              "matchCriteriaId": "F1F136A0-021D-43FE-BDD3-AD7201F7FC03"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s5:*:*:*:*:*:*",
              "matchCriteriaId": "37147BC9-9ED8-48AE-906A-614AD8600962"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s6:*:*:*:*:*:*",
              "matchCriteriaId": "7897729C-4128-49E9-B4A1-25353BC4DBB2"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*",
              "matchCriteriaId": "78481ABC-3620-410D-BC78-334657E0BB75"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*",
              "matchCriteriaId": "BE8A5BA3-87BD-473A-B229-2AAB2C797005"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*",
              "matchCriteriaId": "8B74AC3E-8FC9-400A-A176-4F7F21F10756"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*",
              "matchCriteriaId": "CB2D1FCE-8019-4CE1-BA45-D62F91AF7B51"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:*",
              "matchCriteriaId": "175CCB13-76C0-44A4-A71D-41E22B92EB23"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:*",
              "matchCriteriaId": "166BFDB3-1945-4949-BC2B-E18442FF2E4D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s2:*:*:*:*:*:*",
              "matchCriteriaId": "5923610F-878C-48CA-8B5D-9C609E4DD4DB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s3:*:*:*:*:*:*",
              "matchCriteriaId": "A7C207E3-0252-4192-8E8C-E2ED2831B4F4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s4:*:*:*:*:*:*",
              "matchCriteriaId": "E6974492-FE69-4340-8881-61C3329C1545"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s5:*:*:*:*:*:*",
              "matchCriteriaId": "279E59FE-96DF-4E1D-A3A2-61D180F04533"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "89524D6D-0B22-4952-AD8E-8072C5A05D5C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:*",
              "matchCriteriaId": "AD69A194-1B03-44EA-8092-79BD10C6F729"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:*",
              "matchCriteriaId": "8463ADB4-B8A7-4D63-97A9-232ED713A21C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r1-s2:*:*:*:*:*:*",
              "matchCriteriaId": "FE68337F-106E-4317-A5B6-292B0159F577"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r2:*:*:*:*:*:*",
              "matchCriteriaId": "266B520A-482A-43F7-90F8-B9D64D30034F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r2-s1:*:*:*:*:*:*",
              "matchCriteriaId": "AC78BC9E-5DA7-4E42-9923-B49A0B7F3564"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r2-s2:*:*:*:*:*:*",
              "matchCriteriaId": "DD99F1B0-82B0-4CD3-8C8F-C0FFF44A8B90"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*",
              "matchCriteriaId": "C452BDCB-34E3-42D3-8909-2312356EB70A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*",
              "matchCriteriaId": "2B8158F2-2028-40E9-955F-CFD581A32F60"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:*",
              "matchCriteriaId": "1A7233A1-EC7A-4458-9AE1-835480A03A21"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:*",
              "matchCriteriaId": "D74087E2-5CAA-4085-8408-EB70EC1D5D91"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r2:*:*:*:*:*:*",
              "matchCriteriaId": "0EEF1798-F3C2-4645-96E7-1E82368B184D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r2-s1:*:*:*:*:*:*",
              "matchCriteriaId": "C8BB5EE1-04C7-4DF3-807A-06005ECFEEE5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:25.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "1B7572BB-9C77-4214-9C5F-CC83C7B93E37"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:25.2:r1:*:*:*:*:*:*",
              "matchCriteriaId": "CAADBF98-38BE-40E2-AF1B-9077DCED0809"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:25.2:r1-s1:*:*:*:*:*:*",
              "matchCriteriaId": "558F0A4C-0C72-4BF1-B2DE-C0D3BFD54BCD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos:25.2:r1-s2:*:*:*:*:*:*",
              "matchCriteriaId": "127FE528-AB27-4B18-AF3B-1BE7C0AEEE20"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://kb.juniper.net/JSA107807",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}