Four vendors published security fixes on October 14 for critical and high-severity flaws in Juniper Junos OS, Dell Wyse Management Suite, the NLnet Labs NSD DNS server and SonicWall NSM On-Prem. None of the vendors report confirmed exploitation, and the sources note no public proof-of-concept code.
Juniper’s JSA112187 Bulletin Covers More Than 60 Junos OS Flaws
Juniper’s largest bulletin, JSA112187, covers more than 60 vulnerabilities in Junos OS and Junos OS Evolved, many rated CVSS 9.8. Juniper found them internally and says it is “not aware of any malicious exploitation.”
J-Web Flaws: CVE-2026-101954, CVE-2026-101986 and CVE-2026-101983
Several of the critical flaws involve the J-Web management interface. CVE-2026-101954 allows unauthenticated full device takeover when J-Web is enabled. CVE-2026-101986 is a pre-authentication CGI execution flaw in J-Web. CVE-2026-101983 allows remote code execution through a J-Web virtual domain.
CVE-2026-33796 and the Second Bulletin, JSA112188
CVE-2026-33796 permits remote root command execution when BMP route monitoring is in use. A second bulletin, JSA112188, fixes 11 more flaws, including CVE-2026-101956, which allows root command execution through J-Web.
Dell Fixes Four Cross-Site Scripting Flaws in Wyse Management Suite
Dell’s advisory DSA-2026-405 fixes four cross-site scripting flaws in Wyse Management Suite, the worst rated CVSS 9.0. No exploitation is confirmed. Cross-site scripting flaws let an attacker run script in another user’s browser session, and in a management console that session may carry administrative rights, which explains the high score despite the vulnerability class.
NLnet Labs Patches Four Stack Overwrite Flaws in NSD 4.15.3
NLnet Labs released NSD 4.15.3 on October 14 to fix four high-severity stack overwrite flaws. A crafted zone file can trigger them and allow command execution. Primary servers that load zone files supplied by others face the greatest risk, since those servers read the content an attacker would control.
NSD 4.15.3 and the Risk to Primary Servers Loading Supplied Zone Files
The attack path depends on a server accepting a zone file it did not author. Secondary servers that receive zone data by transfer from a trusted primary are not described as the main exposure in the sources, so the risk concentrates in operators who import zone files from customers or other outside parties.
SonicWall Chains CVE-2026-96540 and CVE-2026-100232 for Full NSM Control
SonicWall fixed CVE-2026-96540 (CVSS 8.8, privilege escalation) and CVE-2026-100232 (CVSS 7.2, OS command injection) in Network Security Manager On-Prem version 4.4.0 and later. The two can be chained for full system control. SonicWall reports no evidence of exploitation.
Individually, the 7.2 command injection might look like a lower priority, but the pairing with a privilege escalation raises the combined impact. Scoring each CVE alone can understate the risk when a lower-severity flaw is reachable after a different flaw has already granted the needed access.
Core Infrastructure Across Junos OS, Wyse, NSD and SonicWall NSM
All four vendors published fixes on the same day, and the affected products are core infrastructure: routers, firewalls, a management console and DNS servers. The sources report no public proof-of-concept code and no active exploitation for any of them.
The Juniper bulletin stands out for scale. A single advisory covering more than 60 flaws, with many at CVSS 9.8, concentrates a large volume of remediation work into one release, and Juniper’s statement that it found the bugs internally indicates the volume came from its own review. The patch guidance for all four vendors is to move to fixed releases: patched Junos builds, NSD 4.15.3, SonicWall NSM 4.4.0 or later, and the latest Dell Wyse Management Suite patch.
For network teams, the practical difficulty is that the same day brought fixes for a router operating system, a DNS server, a firewall management platform and a thin-client management suite, each on its own maintenance cycle. None of the advisories describes an attack in progress, which leaves scheduling in the hands of each organization.
