CVE-2026-21902: Juniper PTX Routers — One Packet to Root (CVSS 9.8)

The Vulnerability That Could Take Down Your Backbone Juniper Networks just dropped an out-of-cycle security bulletin for CVE-2026-21902 — a CVSS 9.8 critical vulnerability in Junos OS Evolved running on PTX Series routers. An unauthenticated, network-based attacker can execute arbitrary code as root . No credentials needed. No user interaction required. PTX routers sit at the core of ISP backbones, data center interconnects, and enterprise WAN edges. A single compromised PTX can cascade into a full network outage. What Went Wrong The vulnerability lives in the On-Box Anomaly Detection framework — ironically, a security feature. The framework was designed to be accessible only by internal processes, but a permissions misconfiguration (CWE-276: Incorrect Default Permissions) exposed it on an externally reachable port. The attack flow: Attacker → External Port → Anomaly Detection Framework → Code Execution as root No exploit chain needed. No privilege escalation. Straight to root in one s