Junos OS Evolved EUVD-2026-101425

Exploitation requires access to the gNMI listener on Junos OS Evolved and the ability to submit an analytics sensor resource - i.e. management-plane access to the device's telemetry/gNMI service. The description explicitly characterizes the actor as an 'authenticated network attacker', so valid credentials or an established management session are a prerequisite, and the gNMI listener must be reachable and enabled (telemetry/JTI dial-out configured). Limiting factors: the gNMI/management interface should not be exposed to untrusted networks in a hardened deployment, and authentication gates access; impact is confined to telemetry dial-out availability (loss of monitoring/analytics streaming) rather than data-plane traffic forwarding. Note the input CVSS PR:N contradicts the described authentication requirement - verify with Juniper JSA112250.

This is a legitimate operational-priority issue for Juniper-based networks, but not a mass-exploitation emergency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, score 8.2) is driven almost entirely by the high availability impact (A:H) of a persistent telemetry dial-out outage. There is a direct conflict in the input that must be flagged: the CVSS vector encodes PR:N (no privileges / unauthenticated), yet the description explicitly states 'an authenticated network attacker' submitting resources 'through gNMI listener' - gNMI is an authenticated management-plane interface, so the PR:N metric appears understated and should be verified against the Juniper advisory (JSA112250). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or automated exploitation. The realistic signal is a high-impact-but-access-gated defect: an attacker must already hold management-plane/gNMI credentials, which sharply narrows the threat population to insiders or adversaries who have already compromised management access. Net: patch on a normal-to-expedited cycle for exposed Junos OS Evolved devices, but this does not carry the urgency of an unauthenticated, actively exploited flaw.

An attacker with valid gNMI/management-plane credentials (or who has pivoted onto the management network) connects to the Junos OS Evolved gNMI listener and submits a crafted analytics sensor resource containing externally-controlled format specifiers. The jti-dialoutd telemetry process mishandles the format string (CWE-134), crashing or wedging telemetry dial-out persistently so network monitoring and analytics streaming stop until intervention. No public exploit code was identified at time of analysis; low attack complexity (AC:L) means a single crafted submission is sufficient once access is obtained.