Advisory severityMedium6.1Juniper Networks

Medium [CVE-2026-21904] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the list filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator

This medium-severity Juniper Networks advisory covers CVE-2026-21904; related products: Junos Space, Junos.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-21904 Source published Apr 10, 2026Source updated Jul 8, 2026

VulniPulse record published Jul 5, 2026Record updated Aug 3, 2026

CVE-2026-21904

Monitor future Juniper Networks CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the

list filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.

This issue affects all versions of Junos Space before 24.1R5 Patch V3.

Affected versions

before 24.1R5

Official advisory · high-confidence parse· fetched 4 months ago·verify at source

Fixed versions

24.1R5

Official advisory · high-confidence parse· fetched 4 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation

This issue affects all versions of Junos Space before 24.1R5 Patch V3.

Official advisory · high-confidence parse· fetched 4 months ago·verify at source

Sources

Official and corroborating records used to build this advisory.

NVD discovery recordNVD
Independent discovery and scoring cross-reference. Vendor remediation guidance takes precedence. Discovered from the machine-readable feed https://services.nvd.nist.gov/rest/json/cves/2.0; this link opens the NVD record for CVE-2026-21904 instead of the raw feed document.
NIST National Vulnerability Database

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-21904NVD CVE.org MITRE

Official resources

Junos Space upgrade documentation (target: 24.1R5)
Official documentation
This advisory names 24.1R5 as the first fixed release — official upgrade documentation for Junos Space Network Management.
Juniper Security Advisories portal
Official documentation
Canonical Juniper SIRT advisory portal — search here for the full JSA text and revisions.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.