Critical Flaw in Juniper PTX Routers: Unauthenticated Root Access Discovered

Juniper has issued an out-of-cycle security bulletin for CVE-2026-21902 — a critical CVSS 9.8 unauthenticated remote code execution flaw in the On-Box Anomaly detection framework on Junos OS Evolved PTX Series routers that is enabled by default; administrators should immediately upgrade to fixed versions (25.4R1-S1-EVO or later) or apply mitigations (restrict access via filters or run 'request pfe anomalies disable') while Juniper reports no known exploitation to date.