Is CVE-2026-21916 actively exploited?

No active exploitation of CVE-2026-21916 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-21916 be exploited remotely?

No. CVE-2026-21916 requires local access to exploit.

What is the CVSS score of CVE-2026-21916?

CVE-2026-21916 has a CVSS score of 7.3 (HIGH).

HOME VULNERABILITIESCVE-2026-21916

HIGH

CVE-2026-21916

CWE-61Published: April 9, 2026· Updated: Apr 13, 2026

7.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.7th

Official Description

A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system.

When after a user has performed a specific 'file link ...' CLI operation, another user commits (unrelated configuration changes), the first user can login as root.

This issue affects Junos OS:

* all versions before 23.2R2-S7,

* 23.4 versions before 23.4R2-S6,

* 24.2 versions before 24.2R2-S3,

* 24.4 versions before 24.4R2-S2,

* 25.2 versions before 25.2R2.

This issue does not affect versions 25.4R1 or later.

NVD Source

Technical Analysis

CVE-2026-21916 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.3.