CVE-2025-59978: Junos Space: Stored cross-site scripting vulnerability in web application

Severity: critical (CVSS 9.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-09 · updated 2026-10-08
Weakness: CWE-79

Description

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to store script tags directly in web pages that, when viewed by another user, enable the attacker to execute commands with the target's administrative permissions. This issue affects all versions of Junos Space before 24.1R4.

Affected products

Juniper Networks Junos Space: before 24.1; 24.1-r1, 24.1-r2, 24.1-r3 — fixed in 24.1

How to fix

Upgrade to a fixed version: Juniper Networks Junos Space 24.1. Check the vendor advisory for mitigations.

References

https://supportportal.juniper.net/JSA103140

Get alerted when CVE-2025-59978 or the next vulnerability affects your stack