Medium severity · published Jan 15, 2026
CVE-2026-21907
Junos Space: TLS/SSL server supports use of static key ciphers (ssl-static-key-ciphers)
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
A Use of a Broken or Risky Cryptographic Algorithm vulnerability in the TLS/SSL server of Juniper Networks Junos Space allows the use of static key ciphers (ssl-static-key-ciphers), reducing the confidentiality of on-path traffic communicated across the connection. These ciphers also do not support Perfect Forward Secrecy (PFS), affecting the long-term confidentiality of encrypted communications.This issue affects all versions of Junos Space before 24.1R5.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Junos Space · Juniper Networks
before 24.1R5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21907
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21907
Vendor Advisory
https://kb.juniper.net/JSA106006
Vendor Advisory
https://supportportal.juniper.net/JSA106006
More from Junos Space
9.0
CVE-2025-59978
Junos Space: Stored cross-site scripting vulnerability in web application
8.8
CVE-2019-0017
Junos Space: Unrestricted file upload vulnerability
7.5
CVE-2025-59975
Junos Space: Flooding device with inbound API calls leads to WebUI and CLI management access DoS
6.5
CVE-2025-59976
Junos Space: Arbitrary file download vulnerability in web interface
6.5
CVE-2019-0016
Junos Space: Authenticated user able to delete devices without delete device privileges