Junos OS Evolved CVE-2026-102012

Exploitation requires that the device be running the na-grpcd gRPC daemon with a gRPC/telemetry subscription service (e.g., gNMI/JTI dial-in telemetry) enabled and reachable by the attacker; the specific trigger is a crafted gRPC telemetry subscription request. The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required once the gRPC endpoint is reachable, so the primary limiting factors are network exposure of the gRPC telemetry port and whether telemetry subscription is configured - devices that do not expose or enable gRPC telemetry, or that restrict management-plane access via firewall/ACL, are not exposed. Impact is limited to availability (process crash / DoS); Recovery=Automatic (R:A) suggests the process restarts, bounding outage duration.

This is a credible operational priority but not a code-execution emergency. The CVSS 4.0 signals (AV:N/AC:L/AT:N/PR:N/UI:N) describe a remote, unauthenticated, low-complexity attack with no user interaction - the easiest class of trigger - and the 8.7 (High) score is driven entirely by a High availability impact (VA:H) on the vulnerable system, with a minor subsequent availability effect (SA:L) and zero confidentiality or integrity impact (VC:N/VI:N). This is consistent with a CWE-617 reachable assertion: a crafted input deterministically crashes the na-grpcd process rather than leaking data or executing code. Supplemental 4.0 metrics reinforce a DoS reading: Automatable=Yes (AU:Y) and Recovery=Automatic (R:A), meaning the attack can be scripted but the service self-recovers, limiting dwell-time damage versus a permanent compromise. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit tooling - the real-world exploitation likelihood cannot be quantified from the data given and should be treated as low-to-unknown until an EPSS value is available. Net: a genuine remote DoS against a core routing-plane telemetry daemon that warrants prompt patching on exposed devices, but it is an availability-only issue with automatic recovery, not a high-CVSS-but-trivial-risk false alarm nor a data-breach-grade threat.

An attacker with network reachability to a Junos OS Evolved device's gRPC telemetry interface sends a specially crafted gRPC telemetry subscription request that triggers a reachable assertion in the na-grpcd process, causing it to crash. Because the vector is remote, unauthenticated, low-complexity and requires no user interaction, the request can be repeated to sustain a denial of service against telemetry (and potentially related management-plane) functionality. No public exploit identified at time of analysis.