CVE-2026-101965 Juniper Networks CVE debrief

Who should care

Network administrators and security teams responsible for Junos OS Evolved deployments, particularly those with network analytics telemetry enabled, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-101965 is a high-severity vulnerability in Junos OS Evolved that can cause telemetry disruption, information disclosure, or potential root-level code execution. Network administrators and security teams should assess exposure and prioritize remediation, particularly for deployments with network analytics telemetry enabled.

• Telemetry service disruption may impact network monitoring and analytics capabilities.
• Potential information disclosure may compromise sensitive network data.
• Possible root-level code execution may allow for unauthorized access and control.

Technical summary

A Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service. The vulnerability affects Junos OS Evolved deployments with network analytics telemetry enabled. The gNMI service is vulnerable, and defenders should review and apply vendor-provided remediation for affected versions to prevent potential impacts.

Defensive priority

High-priority assessment and remediation recommended for Junos OS Evolved deployments with network analytics telemetry enabled.

Recommended defensive actions

• Assess Junos OS Evolved deployments for exposure, particularly those with network analytics telemetry enabled.
• Review and apply vendor-provided remediation for affected versions.
• Monitor gNMI service for suspicious activity.
• Verify telemetry service configuration and access controls.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability in Junos OS Evolved, including affected versions and potential impacts. The vulnerability is a Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved. The gNMI service is affected, and an authenticated network attacker can cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message. The source item and CVE record provide evidence of the vulnerability,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.