CVE-2026-101965 in Junos OS Evolved
Summary
by MITRE • 10/15/2026
An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability represents a critical security flaw within the gRPC daemon component of Juniper Networks Junos OS Evolved, specifically affecting the gNMI (gRPC Network Management Interface) service. This interface is commonly utilized by network administrators and automated orchestration systems to retrieve configuration data, monitor system state, and push configurations to network devices. The core issue stems from a Use of Externally-Controlled Format String weakness, which falls under CWE-134 in the Common Weakness Enumeration taxonomy. In this context, the gRPC daemon fails to properly sanitize or validate input strings before processing them as format arguments for string formatting functions such as printf or similar variants. This lack of validation allows an attacker who has already obtained valid authentication credentials for the device to inject maliciously crafted format specifiers into network management messages.
From a technical perspective, the exploitation mechanism relies on the ability of an authenticated user to send specially constructed gNMI requests that contain control characters designed to manipulate the stack or memory layout during string processing operations. When the daemon processes these malformed inputs without adequate checks, it interprets attacker-supplied format specifiers as instructions for reading from or writing to arbitrary memory locations. This behavior deviates significantly from secure coding practices mandated by standards such as OWASP and CWE-134, which emphasize that all user-controlled input must be treated as untrusted data until explicitly validated against a strict whitelist of expected formats. The absence of this validation creates a direct pathway for memory corruption or unintended information retrieval within the context of the gRPC service process.
The operational impact of this vulnerability is severe and multifaceted, ranging from denial-of-service conditions to complete system compromise. An authenticated attacker can exploit the format string flaw to cause telemetry-service disruption by crashing the gRPC daemon, thereby interrupting network monitoring and management capabilities for the entire device or cluster. More critically, through careful manipulation of stack pointers and memory addresses via specific format specifiers like %x, %n, or %s, an attacker may achieve arbitrary code execution with root-level privileges. This is particularly dangerous because Junos OS Evolved often runs critical network infrastructure services under elevated permissions, meaning successful exploitation grants the adversary full control over the operating system, potentially allowing them to pivot into other parts of the enterprise network, exfiltrate sensitive configuration data, or install persistent backdoors.
In terms of threat modeling and attack classification, this vulnerability aligns with MITRE ATT&CK techniques related to Command and Control via Application Layer Protocol as well as Privilege Escalation through local exploitation mechanisms like T1068. The requirement for authentication means that the initial access vector is limited to insiders or attackers who have compromised administrative credentials, but once inside, the lateral movement potential is high due to the root-level execution capability. This scenario highlights the risks associated with exposing management interfaces directly to networks where credential theft or insider threats are plausible attack vectors.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is applying the vendor-provided software patches that address this specific flaw in Junos OS Evolved, ensuring all gRPC services are updated to versions with proper input validation logic implemented. Administrators should also enforce strict access controls by limiting connectivity to the gNMI service only from trusted management stations using IP allow-listing and multi-factor authentication where possible. Additionally, deploying network intrusion detection systems configured to detect anomalous patterns in gRPC traffic or malformed string sequences can provide an additional layer of defense-in-depth. Regular audits of external-facing services and adherence to secure coding guidelines that mandate the use of safe formatting functions with fixed format strings rather than user-controlled ones are essential for preventing similar vulnerabilities in future software updates.