CVE-2026-102012 Juniper Networks CVE debrief

Who should care

Network administrators and security teams responsible for Junos OS Evolved systems should assess exposure and prioritize verification of gRPC telemetry configurations.

Why it matters

CVE-2026-102012 is a high-severity vulnerability in Junos OS Evolved that allows remote unauthenticated attackers to cause denial-of-service attacks via gRPC telemetry subscription requests. Network administrators and security teams should prioritize verification of gRPC telemetry configurations and assess exposure to potential attacks. The vulnerability has a CVSS score of 7.5 and is considered high severity.

• Potential denial-of-service attacks via gRPC telemetry subscription requests
• Need to verify gRPC telemetry configurations and assess exposure
• Potential impact on network availability and reliability

Technical summary

A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request. The vulnerability is caused by a faulty assertion in the na-grpcd process that can be triggered by a specifically crafted gRPC telemetry subscription request, leading to a denial-of-service condition. Network administrators and security teams should prioritize verification of gRPC telemetry configurations and assess exposure to potential denial-of-service A

Defensive priority

Network administrators and security teams should prioritize verification of gRPC telemetry configurations and assess exposure to potential denial-of-service attacks.

Recommended defensive actions

• Verify gRPC telemetry configurations and assess exposure to potential denial-of-service attacks
• Review and update Junos OS Evolved versions to ensure they are not affected
• Monitor network logs for potential exploitation attempts

Evidence notes

The CVE record and source item provide details on a Reachable Assertion vulnerability in Junos OS Evolved, allowing a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.