Junos OS Symlink Escalation (23.2R2, 23.4R2-S6, 24.2R2-S3, 24.4R2-S2, 25.2R2)
CVE-2026-21916 Published on April 9, 2026
Junos OS: A low privileged user can escalate their privileges so that they can login as root
A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system.
When after a user has performed a specific 'file link ...' CLI operation, another user commits (unrelated configuration changes), the first user can login as root.
This issue affects Junos OS:
* all versions before 23.2R2-S7,
* 23.4 versions before 23.4R2-S6,
* 24.2 versions before 24.2R2-S3,
* 24.4 versions before 24.4R2-S2,
* 25.2 versions before 25.2R2.
This issue does not affect versions 25.4R1 or later.
Vulnerability Analysis
CVE-2026-21916 is exploitable with local system access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Symlink following Vulnerability?
The software, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the software to operate on unauthorized files. A software system that allows UNIX symbolic links (symlink) as part of paths whether in internal code or through user input can allow an attacker to spoof the symbolic link and traverse the file system to unintended locations or access arbitrary files. The symbolic link can permit an attacker to read/write/corrupt a file that they originally did not have permissions to access.
CVE-2026-21916 has been classified to as a Symlink following vulnerability or weakness.
Products Associated with CVE-2026-21916
Want to know whenever a new CVE is published for Juniper Networks Junos? stack.watch will email you.
Affected Versions
Juniper Networks Junos OS:- Before 23.2R2-S7 is affected.
- Version 23.4 and below 23.4R2-S6 is affected.
- Version 24.2 and below 24.2R2-S3 is affected.
- Version 24.4 and below 24.4R2-S2 is affected.
- Version 25.2 and below 25.2R2 is affected.
- Version 25.4R1 is unaffected.