Is CVE-2026-48694 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48694 being exploited in the wild.

How severe is CVE-2026-48694?

Informational severity, with a CVSS score of 8.1, published 26 May 2026.

Which products and versions are affected?

FastNetMon LTD FastNetMon Community Edition through 1.2.9.

Is there a fix for CVE-2026-48694?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-48694 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48694?

Check whether you run FastNetMon LTD FastNetMon Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48694: FastNetMon Community Edition configuration injection in Juniper plugin

CVE-2026-48694 · Severity: info · CVSS 8.1 · Published 2026-05-26

FastNetMon is a DDoS detection tool that can automatically instruct network routers to block malicious traffic. A vulnerability in its Juniper router integration allows an attacker to bypass security controls and send unauthorized commands to the router. This could lead to a complete takeover of the router, allowing attackers to modify routing tables, disable firewalls, or create backdoor administrative accounts.

Technologies: FastNetMon LTD FastNetMon Community Edition. Vendors: FastNetMon LTD.

Quick answers

Is CVE-2026-48694 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48694 being exploited in the wild.
How severe is CVE-2026-48694?: Informational severity, with a CVSS score of 8.1, published 26 May 2026.
Which products and versions are affected?: FastNetMon LTD FastNetMon Community Edition through 1.2.9.
Is there a fix for CVE-2026-48694?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48694 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48694?: Check whether you run FastNetMon LTD FastNetMon Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A configuration injection vulnerability exists in the Juniper NETCONF plugin (`src/juniper_plugin/fastnetmon_juniper.php`) of FastNetMon Community Edition. The `$IP_ATTACK` variable, sourced from command-line arguments, is interpolated directly into Junos CLI configuration strings without validation or sanitization. By embedding newline characters (`\n`) into the IP address string, an attacker can inject arbitrary `set` or `delete` commands into the NETCONF session. This allows for unauthorized modification of any configuration element accessible via the plugin's credentials, including routing policies, firewall filters, and system users. As of May 2026, no official patch has been released.

Affected products

FastNetMon LTD FastNetMon Community Edition through 1.2.9

Timeline

2026-04-25: other: Vendor notified by Lorikeet Security
2026-05-23: advisory: Public advisory released by Lorikeet Security
2026-05-26: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.