Paper/Archive/CVE-2026-101967

CVE-2026-101967

Juniper Networks Junos OS Evolved — Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used

EPSS 4%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 90.3.903 × 2018.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.

Affected

ProductAffectedFixed inSource

Junos OS Evolved24.4 – < 24.4R2-S5-EVO24.4R2-S5-EVOCNA

Junos OS Evolved25.2 – < 25.2R2-S2-EVO25.2R2-S2-EVOCNA

Junos OS Evolved25.4 – < 25.4R1-S3-EVO25.4R1-S3-EVOCNA

Junos OS Evolved26.2 – < 26.2R1-S2-EVO26.2R1-S2-EVOCNA

Junos OS Evolved23.4X100–CNA

Junos OS Evolved25.2X100 – < 25.2X100-D35-EVO25.2X100-D35-EVOCNA

Junos OS Evolved25.4X300 – < 25.4X300-D40-EVO25.4X300-D40-EVOCNA

Scores by source

juniper (CNA)9.3CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H

juniper (CNA)8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorysupportportal.juniper.net/JSA112250