CVE-2026-101978: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Juniper Networks Junos OS Evolved

This vulnerability (CVE-2026-101978) involves improper neutralization of special elements used in an OS command (CWE-78) within the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series. An unauthenticated attacker with access to the management LAN can exploit this flaw by crafting a malicious gRPC response, leading to remote code execution with root privileges. The affected versions include multiple release ranges across 23.x, 24.x, 25.x, and 26.x branches of Junos OS Evolved. The CVSS 3.1 vector indicates the attack requires local network access (AV:A), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and results in high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker on the management LAN to execute arbitrary commands as root on the affected device. This can lead to full system compromise, including unauthorized access to sensitive data, disruption of device operations, and potential network-wide impact due to the critical role of PTX Series routers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict management LAN access to trusted users and networks to reduce exposure. Monitor for any vendor updates or official fixes addressing this vulnerability.