CVE-2026-102085
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
An improper restriction of communication channel to intended endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause limited information disclosure and availability impact to the device. Due to wrong initialization, a process that should only communicate internally can be reached over the network via an open port, leading to inadvertent exposure and increased CPU cycles spent processing ingress packets.
Risk Assessment
An attacker can access an internal process over the network, potentially leading to information disclosure and increased CPU load, possibly degrading services. This issue is similar to CVE-2026-33803.
Recommendation
Upgrade Junos OS Evolved to fixed versions (e.g., 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S4-EVO, 25.2R2-S1-EVO, 25.4R1-S1-EVO). Review and restrict access to open ports.
Other vulnerabilities in Junos OS Evolved
See all- CVE-2026-101978High
An OS command injection vulnerability in the bootzd zero-touch provisioning daemon of Junos OS Evolved on PTX Series allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response.
- CVE-2026-101967High
An OS command injection vulnerability in the bootzd zero-touch provisioning daemon of Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted DHCP response.
- CVE-2026-102068High
A stack-based buffer overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP.
- CVE-2026-102045Medium
An Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port.
- CVE-2026-102023High
A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured.
- CVE-2026-102012High
A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request.
- CVE-2026-101985Medium
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service.
- CVE-2026-101966High
A use of externally-controlled format string vulnerability in the jti-dialoutd of Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener.
- CVE-2026-101965High
A use of externally-controlled format string vulnerability in the gRPC daemon of Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.
- CVE-2026-101960Medium
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash.
Original NVD description (English source)
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device. Due to a wrong initialization, a process which should only be able to communicate internally within the device can be reached over the network via an open port. This leads to a device being inadvertently exposed and increased CPU cycles spent processing ingress packets. This issue affects Junos OS Evolved: * All versions before 23.2R2-S7.7-EVO; * 23.4 versions before 23.4R2-S8.11-EVO; * 24.2 versions before 24.2R2-S5.6-EVO; * 24.4 versions before 24.4R2-S4-EVO; * 25.2 version before 25.2R2-S1-EVO; * 25.4 versions before 25.4R1-S1-EVO. Please note that this issue is similar to but not identical CVE-2026-33803.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS