Junos OS Evolved: Format string flaw in telemetry dial-out daemon
Summary
The telemetry dial-out daemon jti-dialoutd in Juniper Networks Junos OS Evolved is affected. According to the CNA description, an authenticated network attacker can submit a crafted analytics sensor resource via the gNMI listener, which triggers an externally controlled format string. This causes a persistent telemetry dial-out denial of service. The CVSS 4.0 vector in the request lists no privileges required, which conflicts with the description; verify before scoring.
Affected
- Junos OS Evolved 25.4 before 25.4R1-S3-EVO
- Junos OS Evolved 26.2 before 26.2R1-S2-EVO
- Junos OS Evolved 23.4X100
- Junos OS Evolved 25.2X100 before 25.2X100-D35-EVO
- Junos OS Evolved 25.4X300 before 25.4X300-D40-EVO (upper bound unconfirmed by some sources)
- Default configuration is unaffected.
Fixed in
- 25.2X100-D35-EVO
- 25.4R1-S3-EVO
- 25.4X300-D40-EVO
- 26.2R1-S2-EVO
- 23.4X100: Unknown. No fixed release found in the sources; check JSA112250.
Workaround
- No known workarounds.
Exploitation
- Juniper SIRT is not aware of malicious exploitation.
- No public exploit reported by VulDB.
- Not listed in CISA KEV. CISA SSVC shows exploitation: none, automatable: yes.
Our recommendation
- Confirm whether any device runs Junos OS Evolved and which release it runs.
- Check whether gNMI or telemetry dial-out is configured.
- Restrict gNMI access to management networks.
- Upgrade to a fixed release from JSA112250. For 23.4X100, obtain guidance from Juniper.
- Patch sibling CVE-2026-101965 (gNMI gRPC daemon) in the same cycle where gNMI is in use.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112250 supportportal.juniper.net
- VulDB entry 420095 vuldb.com
- OpenCVE CVE-2026-101966 app.opencve.io
- Strix CVE-2026-101966 www.strix.ai
- Strix CVE-2026-101965 (sibling gNMI issue) www.strix.ai
- OffSeq radar CVE-2026-101966 radar.offseq.com
- SecurityOnline: Juniper patches critical Junos OS vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:43.
Original description (NVD)
A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.