Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-101967: Juniper Junos OS Evolved can be hijacked via DHCP
CVE-2026-101967 · published today
Summary
The zero‑touch provisioning service in Juniper Junos OS Evolved can be tricked by a forged DHCP reply on the management network, letting an unauthenticated attacker run commands with full system privileges. This gives the attacker complete control over the device. Protect the management LAN, use authenticated DHCP or disable zero‑touch provisioning until a patch is applied.
What to do
- Update juniper networks junos os evolved to version 24.4R2-S5-EVO or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| juniper networks | junos os evolved | < 24.4R2-S5-EVO |
Original advisory text
Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.
References
- https://supportportal.juniper.net/JSA112250 vendor-advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.3
Critical
Type
CWE-78OS Command Injection
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta