CVE-2026-101965: Junos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabled
An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.4R2-S5-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2R2-S2-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2X100-D35-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R1-S3-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R2-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4X300-D40-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.2R1-S2-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.2R2-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.4R1-EVO
Event History
Frequently Asked Questions
Who is exposed to this issue?
Junos OS Evolved deployments with network analytics telemetry enabled are exposed through the gRPC daemon's gNMI service. Exploitation requires an authenticated network attacker.
What could an attacker achieve?
A crafted message sent to the gNMI service can disrupt telemetry services, disclose information, or potentially result in code execution with root-level privileges.
Does exploitation require user interaction or complex conditions?
No user interaction is required, and the vulnerability is rated as low attack complexity. The attacker must already have authentication and network access to reach the affected service.