Junos OS Evolved EUVD-2026-101427

Exploitation requires that the target PTX device be running Junos OS Evolved and actively executing zero-touch provisioning via the bootzd daemon, which processes gRPC provisioning responses - the vulnerable code path is reached by sending a crafted gRPC response that is unsafely passed to an OS command. The attacker must be positioned on the management LAN (CVSS AV:A, not internet-reachable AV:N), so a routed/segmented or physically isolated out-of-band management network materially limits exposure. No authentication is needed (PR:N) and no user interaction is required (UI:N), but the primary limiting factors are adjacent-network positioning and the device being in an active ZTP/provisioning state rather than steady-state operation.

This is a high-severity (CVSS 8.8) OS command injection (CWE-78) yielding root-level code execution, with a CVSS vector of AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H that credibly supports prioritization: low attack complexity, no privileges, and no user interaction. The key risk-limiting signal is AV:A (adjacent/management LAN) rather than AV:N - exploitation requires a foothold on the Junos management network, which contains blast radius to attackers already positioned on that segment. No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The signals are internally consistent (vector matches the description of an unauthenticated adjacent attacker), so no contradictions require vendor verification; the main uncertainty is operational - the bootzd zero-touch provisioning daemon is primarily active during device onboarding, which likely narrows the realistic exposure window below what the raw 8.8 score implies.

An attacker with access to the device management LAN (for example via a compromised provisioning server or lateral movement onto the OOB network) impersonates or intercepts the ZTP gRPC channel and returns a crafted gRPC response to a PTX device running bootzd during zero-touch provisioning. The malicious response is parsed and injected into an OS command, executing attacker-controlled commands as root. No public exploit code is referenced, and success depends on reaching a device while its ZTP workflow is active.