Vulnerability · Published Oct 14, 2026 · Assigned by juniper
CVE-2026-101967Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used
High 8.8
In plain English
A high-severity OS command injection in Junos OS Evolved from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)3.9%top 9.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Junos OS Evolved | 24.4 – before 24.4R2-S5-EVO25.2 – before 25.2R2-S2-EVO25.4 – before 25.4R1-S3-EVO26.2 – before 26.2R1-S2-EVO23.4X10025.2X100 – before 25.2X100-D35-EVO25.4X300 – before 25.4X300-D40-EVO |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://supportportal.juniper.net/JSA112250 vendor-advisory