Junos OS Evolved CVE-2026-101967

Exploitation requires that the target Junos OS Evolved device be actively performing zero-touch provisioning (ZTP) via the bootzd daemon, which processes DHCP responses - typically during initial boot/onboarding before configuration is applied. The attacker must be positioned on the same management LAN / provisioning broadcast segment (CVSS AV:A), able to send a crafted DHCP response that the device will accept, so a rogue or compromised DHCP server or an on-segment spoofing position is the practical prerequisite. Limiting factors: the device must be in ZTP mode (not a fully provisioned production device that has disabled ZTP), and the attacker needs Layer-2/adjacent reachability to the management network - the flaw is not exploitable from the public internet or across routed boundaries without that access. No authentication or user interaction is required (PR:N/UI:N).

This is a genuine high-priority vulnerability, though its exposure is bounded by network position rather than being internet-wide. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an adjacent-network, low-complexity, unauthenticated attack with no user interaction yielding high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) - consistent with root-level OS command injection via a crafted DHCP response. The key limiting signal is AV:A (Adjacent), not AV:N: the attacker must already be on the management LAN / same broadcast or provisioning segment, so this is not a remotely reachable internet-facing flaw. No EPSS score, KEV listing, or POC is present in the input, so exploitation status is 'no public exploit identified at time of analysis'; the 9.3 severity reflects impact and ease once adjacency is achieved, not observed widespread exploitation. The signals are internally consistent (adjacent vector matches 'management LAN' in the description, PR:N matches 'unauthenticated'). The main caveat: absence of EPSS/KEV data means real-world exploitation frequency is simply unknown, not confirmed-low - treat the severity as credible and prioritize patching of exposed ZTP-capable devices while recognizing the adjacency requirement reduces mass-exploitation likelihood.

An attacker with a foothold on the management LAN (e.g., a compromised management host or a rogue device on the provisioning segment) sends a crafted DHCP response to a Junos OS Evolved device performing zero-touch provisioning. The malicious DHCP option values are passed unsanitized to a shell by the bootzd daemon, injecting OS commands that execute as root. No public exploit code is identified at time of analysis, but the low attack complexity and lack of authentication make reliable exploitation feasible once LAN adjacency is obtained.