Juniper Junos OS Evolved: Denial of service via gRPC telemetry subscription request
Summary
Juniper Junos OS Evolved, the network operating system used on Juniper EVO platforms, is affected in its na-grpcd process. A remote, unauthenticated attacker can send a crafted gRPC telemetry subscription request that triggers a reachable assertion and crashes the process, causing a denial of service. The attack is only possible if gRPC is configured with the clear-text port or with skip-authentication. Juniper reports no known malicious exploitation.
Affected
- Junos OS Evolved before 23.2R2-S7.7-EVO
- 23.4 before 23.4R2-S8.11-EVO
- 24.2 before 24.2R2-S5.6-EVO
- 24.4 before 24.4R2-S5-EVO
- 25.2 before 25.2R2-S2-EVO
- 25.4 before 25.4R1-S3-EVO
- 26.2 before 26.2R1-S2-EVO
- 23.4X100 (no fixed release known)
- 25.2X100 before 25.2X100-D35-EVO
- 25.4X300 before 25.4X300-D40-EVO
- Only relevant if gRPC clear-text port or skip-authentication is configured
Fixed in
- 23.2R2-S7.7-EVO
- 23.4R2-S8.11-EVO
- 24.2R2-S5.6-EVO
- 24.4R2-S5-EVO
- 25.2R2-S2-EVO
- 25.2X100-D35-EVO
- 25.4R1-S3-EVO
- 25.4R2-EVO
- 25.4X300-D40-EVO
- 26.2R1-S2-EVO
- 26.2R2-EVO
- 26.4R1-EVO
- All subsequent releases
- Fix for 23.4X100: Unknown.
Workaround
Unknown. No known workarounds are documented by the vendor.
- Check whether gRPC clear-text port or skip-authentication is configured, as the vulnerability requires one of these settings.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept and no KEV listing known at the time of research.
Our recommendation
- Inventory all Junos OS Evolved devices and identify the affected release train.
- Check whether gRPC clear-text or skip-authentication is enabled and whether the gRPC service is reachable from untrusted networks.
- Restrict gRPC and telemetry access to trusted management networks.
- Upgrade to the fixed release for your train as specified in Juniper advisory JSA112250.
- For 23.4X100, obtain guidance from Juniper before relying on any fix.
- Monitor for unexpected restarts of na-grpcd.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper advisory JSA112250 supportportal.juniper.net
- OpenCVE CVE-2026-102012 app.opencve.io
- threatint CVE-2026-102012 cve.threatint.com
- Strix.ai CVE-2026-102012 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:26.
Original description (NVD)
A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.