Junos OS CVE-2026-57032

Exploitation requires that the target be an EX2300, EX3400, EX4000, EX4100 or EX4400 running an affected Junos OS release with the Junos Telemetry Interface / gRPC (gNMI) streaming service reachable, and the attacker must hold a low-privilege authenticated account able to open a gRPC telemetry subscription (CVSS PR:L confirms authentication is needed; not exploitable unauthenticated). The concrete trigger is subscribing to an UNSUPPORTED telemetry sensor path on the pfe - a supported path does not cause the crash. Limiting factors that reduce real-world risk: the gRPC telemetry interface is commonly confined to a management VLAN or specific collector hosts, so an attacker needs network reach to that plane plus valid credentials; the impact is availability-only and self-recovers (R:A) after the FPC restarts, so a single request causes a transient rather than permanent outage; and only the five listed EX models are affected.

The CVSS 4.0 base score is 7.1 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and impact confined to availability (VA:H, SA:L; VC:N/VI:N). This is a genuine availability risk but strictly a DoS - no confidentiality or integrity exposure and no code execution. Positive risk signals: network reachable, low attack complexity, no user interaction, and only low privileges needed, so any authenticated management-plane user or a compromised low-tier account can trigger it. Mitigating signals: exploitation requires authenticated gRPC access to the telemetry interface, which in well-run networks is restricted to a management VLAN or NOC/monitoring systems; no EPSS score was provided, and there is no POC or KEV listing, so there is no evidence of active or opportunistic exploitation. The vector's R:A (automatic recovery) reflects that the FPC self-restarts, limiting damage to a transient outage per trigger - though an attacker scripting repeated subscriptions can sustain the outage. Net: a real patch-worthy priority for EX fleets exposing gRPC telemetry, but lower urgency than an unauthenticated or RCE bug; prioritize by whether telemetry is reachable from untrusted accounts.

An attacker holding a low-privilege authenticated foothold on the switch's management plane - or on a monitoring host permitted to reach the gRPC endpoint - opens a telemetry subscription to a sensor path that the EX platform does not support. The malformed/undefined path resolution crashes the FPC and drops the switch's forwarding for the duration of the auto-restart, and the attacker scripts repeated subscriptions to keep the device offline. No public exploit code has been identified, but the low complexity (AC:L, no user interaction) makes reproduction trivial for anyone with the required access.