Juniper Junos OS EUVD-2026-101385

Exploitation requires the Juniper EX/SRX/QFX device to be running the phone-home daemon (phcd), i.e. actively performing phone-home / zero-touch provisioning (ZTP), and the attacker must occupy the same Layer-2 broadcast domain to operate a rogue DHCP server whose response phcd will process (AV:A, not routable/remote). The limiting factors are therefore network adjacency and the device being in the provisioning state; a device not in phone-home provisioning, or one isolated from attacker-controlled DHCP traffic, is not exposed. No user interaction or authentication is required once those conditions hold (PR:N/UI:N), but the attack cannot be launched from an arbitrary internet position.

This is a genuinely high-priority flaw where the signals largely agree. The CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N with VC:H/VI:H/VA:H) describes adjacent, unauthenticated, no-interaction exploitation yielding full confidentiality, integrity and availability impact, and the description confirms the payoff is arbitrary command execution as root - a severe technical impact consistent with the 8.7 (High) base score. The vendor (Juniper) reported it and a patch is available, which raises confidence in the technical details. However, the practical risk is tempered by two factors the raw score understates: the attack vector is Adjacent (AV:A), meaning the attacker must already be on the same Layer-2 segment and cannot reach this over the internet, and exploitation depends on the device being in the phone-home / zero-touch-provisioning (ZTP) state where phcd processes DHCP responses. No EPSS score was provided, the CVE is NOT on CISA KEV, and no public exploit was supplied in the intelligence - so there is 'no public exploit identified at time of analysis.' In short: a legitimately dangerous root-level command-injection bug on widely-deployed Juniper gear, but one whose real-world exploitation is gated by network adjacency and provisioning state rather than being remotely and broadly weaponizable.

An attacker with a foothold on the same local/adjacent network segment as a Juniper EX/SRX/QFX device that is performing phone-home (ZTP) provisioning stands up a rogue DHCP server. The malicious DHCP response carries crafted data that phcd fails to neutralize, injecting OS commands that execute as root on the device. No public exploit code was identified in the provided data, and exploitation requires Layer-2 adjacency rather than remote internet access.