CVE-2026-101965: CWE-134 Use of Externally-Controlled Format String in Juniper Networks Junos OS Evolved
Description
An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.
CVSS v3.1
Score 8.8high
Affected software
Juniper Networks
Junos OS Evolved
pkg:rpm/juniper/junos-os-evolvedRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-134) exists in the gRPC daemon component of Juniper Networks Junos OS Evolved. An attacker with authentication can exploit an externally-controlled format string weakness in the gNMI service to cause telemetry service disruption, information disclosure, or potentially execute arbitrary code with root-level privileges. The CVSS 3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.
Potential Impact
Successful exploitation can lead to high-impact consequences including disruption of telemetry services, unauthorized disclosure of sensitive information, and potential root-level code execution on affected devices running Junos OS Evolved. This could compromise device integrity and network operations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a fix is available, restrict access to the gNMI service to trusted and authenticated users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- juniper
- Date Reserved
- 2026-09-28T16:28:35.625Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acfaf302cdf04f65694d32c
Added to database: 10/14/2026, 16:34:56 UTC
Last enriched: 10/14/2026, 18:49:18 UTC
Last updated: 10/15/2026, 01:08:17 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.