Description
An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.
Published: 2026-10-14
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An attacker with network authentication can exploit a use‑of‑externally‑controlled format string in the gRPC daemon of Juniper Networks Junos OS Evolved, leading to telemetry‑service disruption, potential information disclosure, or root‑level code execution. The vulnerability is ranked high with a CVSS score of 8.7, indicating significant severity.

Affected Systems

Juniper Networks Junos OS Evolved is affected. The following releases contain the fix: 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Earlier versions remain vulnerable.

Risk and Exploitability

The risk is high for environments where the gNMI service is enabled and accessed by authenticated users on the network. Although the EPSS score is not available, the CVSS of 8.7 demonstrates considerable damage potential. The issue is not currently listed in CISA's KEV catalogue. Attackers need legitimate network credentials and must send a crafted message to the gNMI service, making privilege escalation or local access a typical prerequisite.

Generated by OpenCVE AI on October 14, 2026 at 21:40 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS Evolved: 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Apply the Junos OS Evolved patch from the latest release listed in the vendor's solution.
  • If an immediate update is not possible, temporarily disable the telemetry (gNMI) service to prevent disruption until the vulnerability is resolved.
  • Verify network devices are configured to limit gNMI access to trusted administrators only.

Generated by OpenCVE AI on October 14, 2026 at 21:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.
Title Junos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabled
Weaknesses CWE-134
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-15T03:57:19.320Z

Reserved: 2026-09-28T16:28:35.625Z

Link: CVE-2026-101965

cve-icon Vulnrichment

Updated: 2026-10-14T20:39:51.485Z

cve-icon NVD

Status : Received

Published: 2026-10-14T17:17:48.803

Modified: 2026-10-15T04:18:09.780

Link: CVE-2026-101965

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-14T21:45:07Z

Weaknesses
  • CWE-134

    Use of Externally-Controlled Format String