CVE-2026-21904
published 2026-04-09CVE-2026-21904: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to…
PriorityP427medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.21%
11.4th percentile
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the
list filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.
This issue affects all versions of Junos Space before 24.1R5 Patch V3.
Affected
69 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | junos_os | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Juniper
CVE-2026-21904: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attack
vendor_juniper·2026-04-09·CVSS 6.1
CVE-2026-21904 [MEDIUM] CWE-79 CVE-2026-21904: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attack
CVE-2026-21904: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the
list filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.
This issue affects all versions of Junos Space before 24.1R5 Patch V3.
GHSA
GHSA-3cpj-89qh-f3x6: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attack
ghsa_unreviewed·2026-04-10
CVE-2026-21904 [MEDIUM] CWE-79 GHSA-3cpj-89qh-f3x6: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attack
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the
list filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.
This issue affects all versions of Junos Space before 24.1R5 Patch V3.
VulDB
Juniper Junos Space up to 24.1R4 list filter cross site scripting (JSA106003)
vuldb·2026-04-10·CVSS 5.1
CVE-2026-21904 [MEDIUM] Juniper Junos Space up to 24.1R4 list filter cross site scripting (JSA106003)
A vulnerability identified as problematic has been detected in Juniper Junos Space. This affects an unknown part. This manipulation of the argument list filter causes cross site scripting.
This vulnerability appears as CVE-2026-21904. The attack may be initiated remotely. There is no available exploit.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-09
Published