This vulnerability (CVE-2026-21916) in Juniper Networks Junos OS involves improper handling of symbolic links in the CLI. A local authenticated attacker with low privileges can exploit this by performing a 'file link ...' operation and then waiting for another user to commit configuration changes, which results in the attacker gaining root privileges. Affected versions include all before 23.2R2-S7, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S3, 24.4 versions before 24.4R2-S2, and 25.2 versions before 25.2R2. Versions 25.4R1 and later are not affected. The CVSS v3.1 score is 7.3 (High), reflecting local attack vector, low complexity, required privileges, user interaction, and high impact on confidentiality, integrity, and availability. The vendor manages remediation for this cloud service, and a patch is available.

Successful exploitation allows a local, authenticated attacker with low privileges to escalate to root privileges, resulting in full system compromise. This includes complete control over confidentiality, integrity, and availability of the affected system. The vulnerability can be triggered by a specific sequence of CLI operations involving symbolic link handling and configuration commits.

A patch is available for this vulnerability. Juniper Networks manages remediation for this cloud-hosted service, so users should ensure their Junos OS instances are updated to version 25.4R1 or later, or to the appropriate fixed versions listed by the vendor. Check the official Juniper advisory for the latest patch and update instructions. No additional mitigation actions are specified by the vendor advisory.