Junos OS Evolved: OS command injection in zero-touch provisioning daemon
Summary
An OS command injection vulnerability in the bootzd zero-touch provisioning daemon of Junos OS Evolved, including PTX Series devices, allows an unauthenticated attacker on the management LAN to execute commands as root. The attacker needs to send a crafted DHCP response, and the issue is relevant where zero-touch provisioning is used. Juniper SIRT is not aware of any malicious exploitation.
Affected
- Junos OS Evolved 24.4 to before 24.4R2-S5-EVO
- Junos OS Evolved 25.2 to before 25.2R2-S2-EVO
- Junos OS Evolved 25.4 to before 25.4R1-S3-EVO
- Junos OS Evolved 26.2 to before 26.2R1-S2-EVO
- Junos OS Evolved 23.4X100 (fixed release unknown)
- Junos OS Evolved 25.2X100 to before 25.2X100-D35-EVO
- Junos OS Evolved 25.4X300 to before 25.4X300-D40-EVO
- Default configuration: unaffected
- Exact ranges to be confirmed against Juniper advisory JSA112250, which could not be retrieved
Fixed in
- 23.2R2-S7.7-EVO
- 23.4R2-S8.11-EVO
- 24.2R2-S5.6-EVO
- 24.4R2-S5-EVO
- 25.2R2-S2-EVO
- 25.2X100-D35-EVO
- 25.4R1-S3-EVO
- 25.4R2-EVO
- 25.4X300-D40-EVO
- 26.2R1-S2-EVO
- 26.2R2-EVO
- 26.4R1-EVO
- All subsequent releases
Workaround
Unknown. Juniper states there are no known workarounds for this issue.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- Not listed in CISA KEV at the time of research.
- No public proof of concept found; this is not a confirmed absence.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory all Junos OS Evolved devices and record exact versions.
- Read advisory JSA112250 and confirm the fixed release for each platform.
- Upgrade affected devices to a fixed release.
- Isolate management interfaces on a separate network and review whether zero-touch provisioning is needed.
- Check related CVE-2026-102059 for Junos OS Evolved EX, SRX and QFX devices, which are more common in SMEs.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper advisory JSA112250 supportportal.juniper.net
- Vulnrichment CVE-2026-101967 vulners.com
- Strix.ai CVE-2026-101967 www.strix.ai
- OpenCVE CVE-2026-101967 app.opencve.io
- VulDB 420102 vuldb.com
- Positive Technologies PT-2026-113819 vulners.com
- Related CVE-2026-102059 hol.org
- Wikipedia Junos OS en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:58.
Original description (NVD)
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.