Junos OS Evolved CVE-2026-57028

Exploitation requires network-level reachability to the specific port that, due to incorrect initialization, exposes the internal license-management process on a device running Junos OS Evolved before 23.2R2-EVO - no authentication and no user interaction are needed (PR:N/UI:N). The primary limiting factor is network exposure: the attacker must be able to route packets to that open port, so devices whose management plane and control-plane ports are firewalled to trusted subnets or placed out-of-band are not reachable. The flaw is confined to the Junos OS Evolved variant on affected versions; non-Evolved Junos and patched (23.2R2-EVO+) devices are not exposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3 High) indicates a remotely reachable, low-complexity, unauthenticated flaw with limited but real impact across all three of confidentiality, integrity and availability - consistent with unauthorized access to license management culminating in license exhaustion (an availability/functional-degradation outcome). No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified from the data; the practical severity is bounded by the fact that the demonstrated impact is license exhaustion rather than code execution or full device takeover. This is a legitimate patching priority for internet- or management-plane-exposed devices given the no-authentication network vector, but the 'License' rather than 'System compromise' impact suggests it is a service-degradation issue rather than a critical RCE. Note the input tags label this 'Authentication Bypass', which is broader than the described license-exhaustion effect - treat the authoritative impact as the license-management access stated in the description and Juniper advisory JSA110088.

An attacker with network reachability to a vulnerable Junos OS Evolved device connects to the erroneously exposed port fronting the internal license-management process and, without any credentials, issues requests that consume licensing resources until licenses are exhausted, degrading licensed features on the device. Given AV:N/AC:L/PR:N, no user interaction or authentication is required; no public exploit code is identified at time of analysis, so exploitation would require an attacker to independently develop the interaction.