Vulnerability · Published Apr 9, 2026 · Assigned by juniper

CVE-2025-13914Apstra: SSH host key validation vulnerability for managed devices

High 8.7

In plain English

A high-severity security flaw in Apstra from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows a unauthenticated, MITM attacker to impersonate managed devices. Due to insufficient SSH host key validation an attacker can perform a machine-in-the-middle attack on the SSH connections from Apstra to managed devices, enabling an attacker to impersonate a managed device and capture user credentials. This issue affects all versions of Apstra before 6.1.1.

Affected products (as reported)

Vendor	Product	Versions
Juniper Networks	Apstra	0 – before 6.1.1

Weakness: CWE-322 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

References

https://kb.juniper.net/JSA107862 vendor-advisory