CVE-2026-101978 Juniper Networks CVE debrief

Who should care

Juniper Networks administrators and security teams responsible for Junos OS Evolved on PTX Series deployments should be aware of this high-severity vulnerability and take immediate action to assess exposure, prioritize patching, and monitor for suspicious activity. This includes reviewing and applying official patches or updates, restricting access to the management LAN, and monitoring gRPC responses for suspicious

Why it matters

CVE-2026-101978 is a high-severity OS Command Injection vulnerability in Juniper Networks Junos OS Evolved on PTX Series, allowing unauthenticated attackers to execute commands as root. Juniper Networks administrators and security teams should assess exposure, prioritize patching, and monitor for suspicious activity.

• Potential for unauthenticated command execution as root
• Exposure of Junos OS Evolved on PTX Series to management LAN attacks
• Need for prompt patching or mitigation to prevent exploitation

Technical summary

The bootzd zero-touch provisioning daemon in Juniper Networks Junos OS Evolved on PTX Series is vulnerable to OS Command Injection via a crafted gRPC response, allowing an unauthenticated attacker on the management LAN to execute commands as root. This vulnerability has a high CVSS score of 8.7 and is classified as HIGH severity. Juniper Networks administrators and security teams should assess exposure, prioritize patching, and monitor for suspicious activity.

Defensive priority

High priority for Junos OS Evolved on PTX Series deployments

Recommended defensive actions

• Review and apply Juniper Networks' official patches or updates for Junos OS Evolved on PTX Series
• Restrict access to the management LAN to minimize exposure
• Monitor gRPC responses for suspicious activity

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but vendor-provided information is limited. The bootzd zero-touch provisioning daemon in Juniper Networks Junos OS Evolved on PTX Series is vulnerable to OS Command Injection via a crafted gRPC response. Defenders should verify the vulnerability's impact on their specific deployments and review compensating controls for exposed systems while remediation is scheduled and verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.