Juniper Junos OS Evolved: Format string vulnerability in gRPC daemon
Summary
A format string vulnerability in the gRPC daemon of Juniper Junos OS Evolved can be triggered through a crafted message to the gNMI service. An authenticated attacker on the network can cause telemetry service disruption, disclose information, or potentially execute code with root privileges. According to the CNA record, the issue is linked to network analytics telemetry being enabled, and standard Junos OS is not affected.
Affected
- Junos OS Evolved 24.4 to before 24.4R2-S5-EVO
- Junos OS Evolved 25.2 to before 25.2R2-S2-EVO
- Junos OS Evolved 25.4 to before 25.4R1-S3-EVO
- Junos OS Evolved 26.2 to before 26.2R1-S2-EVO
- Junos OS Evolved 23.4X100 (fixed build unknown)
- Junos OS Evolved 25.2X100 to before 25.2X100-D35-EVO
- Junos OS Evolved 25.4X300 to before 25.4X300-D40-EVO
- Default configuration: not affected. Required configuration includes gRPC extension-service request-response and analytics export-profile with UDP transport.
Fixed in
- 24.4R2-S5-EVO
- 25.2R2-S2-EVO
- 25.2X100-D35-EVO
- 25.4R1-S3-EVO
- 25.4R2-EVO
- 25.4X300-D40-EVO
- 26.2R1-S2-EVO
- 26.2R2-EVO
- 26.4R1-EVO
- All subsequent releases
- 23.4X100: Unknown.
Workaround
No known workarounds according to the CNA record.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- CISA SSVC data lists exploitation as none and automatable as no.
- No public proof of concept found in our research; this does not prove that none exists.
Our recommendation
- Ask whether any Junos OS Evolved devices are in use and which build they run.
- Read Juniper advisory JSA112250 and confirm the fixed build for each release train, including 23.4X100.
- Restrict gNMI and gRPC access to management networks using ACLs.
- Disable telemetry services that are not needed.
- Schedule the update to a fixed release.
- Note that CVE-2026-102012 in the same bulletin is unauthenticated and should be prioritised if gRPC is exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112250 supportportal.juniper.net
- OpenCVE: CVE-2026-101965 app.opencve.io
- Strix: CVE-2026-101965 www.strix.ai
- Vulners VulnRichment: CVE-2026-101965 vulners.com
- OffSeq Radar: CVE-2026-101965 radar.offseq.com
- Juniper gRPC network services documentation www.juniper.net
- Juniper interfaces and telemetry documentation www.juniper.net
- SecurityOnline: Juniper patches critical Junos OS vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:54.
Original description (NVD)
An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.