Junos OS Evolved CVE-2026-101965

Exploitation requires that the gNMI service on the gRPC daemon of Junos OS Evolved be enabled and network-reachable, and that the attacker hold valid low-privileged authentication to that service (CVSS PR:L) - it is not exploitable by a fully anonymous attacker. The specific trigger is a crafted gNMI message carrying attacker-controlled format specifiers reaching the vulnerable format-string sink (CWE-134). Limiting factors: gNMI/telemetry streaming must be configured and exposed (devices without gNMI enabled or with it restricted to a locked-down management plane are not exposed), valid credentials or an authenticated session are needed, and only Junos OS Evolved (not classic Junos OS) is in scope per the affected-product data.

This is a credible priority for organizations running Junos OS Evolved, though not a drop-everything emergency on the available signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack that nonetheless requires some level of authentication (PR:L), with full confidentiality, integrity, and availability impact consistent with the described potential for root-level code execution. The key limiter is PR:L: the attacker must already have valid, low-privileged access to the gNMI/gRPC service, which materially reduces the pool of attackers versus a fully unauthenticated flaw. No EPSS score, no CISA KEV listing, and no public exploit were supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of a high-impact format-string bug (CWE-134) with a vendor advisory but no observed exploitation suggests a serious-but-not-yet-weaponized issue typical of a coordinated vendor disclosure. No SSVC decision data or automatability signal was provided. There are no internal contradictions between the vector and the description (both agree on authenticated network access), so no conflicting-signal caveat is needed here beyond noting the missing EPSS/KEV/POC data.

An attacker who has obtained valid low-privileged credentials for the gNMI service (or has pivoted onto the management network where gNMI is reachable) sends a crafted gNMI message containing attacker-controlled format specifiers to the gRPC daemon. The malformed input is passed into a format-string sink, allowing the attacker to crash or disrupt the telemetry service, read out-of-bounds memory for information disclosure, or in the worst case corrupt memory to achieve root-level code execution on the device. No public proof-of-concept was provided in the input.