CVE-2026-101965

Executive Summary

CVE-2026-101965 is a use of externally-controlled format string vulnerability (CWE-134) in the gRPC daemon of Juniper Networks Junos OS Evolved. An authenticated attacker with network access to the gNMI service can deliver a crafted message that causes telemetry-service disruption, information disclosure, or potential root-level code execution. With a CVSS base score of 8.8 (High), affected deployments require immediate mitigation assessment because no vendor patch has been identified.

Technical Analysis

The vulnerability class is CWE-134, Use of Externally-Controlled Format String. This occurs when an application passes externally supplied data directly into a format-string processing function instead of supplying that data as an argument value. Format-string parsers interpret conversion specifiers embedded in the input; when attacker-controlled, these specifiers can cause out-of-bounds reads (information disclosure), memory corruption, or arbitrary write primitives that may be leveraged for code execution.

In this instance, the vulnerable component is the gRPC daemon of Juniper Networks Junos OS Evolved, and the attack vector is a crafted message directed at the gNMI service. gNMI (gRPC Network Management Interface) is a network management and telemetry protocol used for configuration retrieval, state queries, and streaming telemetry on Junos OS Evolved devices. The NVD description states that the flaw permits three distinct impact outcomes: telemetry-service disruption, information disclosure, and potential root-level code execution. The elevation to root-level execution implies the gRPC daemon processes requests in a privileged context or that successful memory corruption within the daemon is not constrained by sandboxing.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H establishes the following:

• Attack Vector: Network (AV:N) — the attacker does not require local or adjacent access; the gNMI service is reachable over the network.
• Attack Complexity: Low (AC:L) — no specialized conditions or race windows are required beyond sending the crafted message.
• Privileges Required: Low (PR:L) — the attacker must be authenticated and hold at least minimal gNMI credentials before triggering the flaw.
• User Interaction: None (UI:N) — no operator action is needed on the target device.
• Scope: Unchanged (S:U) — the impact is confined to the vulnerable daemon's security authority.
• Confidentiality: High (C:H) — information disclosure is an explicit impact.
• Integrity: High (I:H) — potential root-level code execution implies full integrity loss.
• Availability: High (A:H) — telemetry-service disruption is an explicit impact.

The PR:L rating is significant: this is not an unauthenticated pre-auth RCE. The attacker must already possess valid credentials for the gNMI interface. This reduces the exposure profile to insider threats, credential-compromised positions, or multi-stage attack chains in which credentials are obtained through separate means. However, the low privileges required mean that even a minimally privileged, read-only gNMI credential is sufficient to reach the vulnerable code path.

No public proof-of-concept, exploit code, or Nuclei template has been identified. No affected version ranges are published in the available data, and no vendor patch, workaround, or CVE-to-fix mapping has been observed. The vulnerability is therefore considered unpatched with a patch confidence of 0/4.

Exploitation Scenarios

No public proof-of-concept is available. The attack chain below is inferred from the vulnerability class (CWE-134) and the NVD description of the affected component and interface.

1. Reconnaissance / target identification. The attacker identifies reachable Junos OS Evolved devices exposing the gNMI service. gNMI is typically served over a TCP port associated with gRPC (commonly 9339 for gNMI on Junos, though the exact port is deployment-dependent and not confirmed in the available data). The attacker must confirm the service is reachable and that valid credentials are held or can be obtained.

2. Authenticated access and message construction. Because the CVSS vector specifies PR:L and AV:N, the attacker authenticates to the gNMI service with valid — potentially low-privileged — credentials. The attacker then constructs a crafted gNMI request message that embeds format-string conversion specifiers (%n, %s, %x, etc.) in a field that the gRPC daemon subsequently passes to a format-string handling routine without sanitization.

3. Triggering the flaw. When the daemon processes the crafted message, the externally controlled format string is interpreted by the vulnerable formatting function. This is the core of CWE-134: the data is treated as a format template rather than as inert input.

4. Post-exploitation impact. Depending on which conversion specifiers are used and how many arguments the stack holds, the attacker can achieve one or more of the following, consistent with the NVD description:

   • Telemetry-service disruption: format specifiers such as %s or %n can induce crashes or hangs in the gRPC daemon, interrupting streaming telemetry to upstream collectors.
   • Information disclosure: %x, %p, and similar specifiers can leak stack-resident data, which may include memory addresses and potentially sensitive configuration content.
   • Root-level code execution: with sufficient control over the format string and a memory-corruption primitive (e.g., %n writes), the attacker may achieve arbitrary write and ultimately code execution in the daemon's privilege context, which the description characterizes as root-level.

Because there is no public exploit and no confirmed memory layout, the precise exploitability and reliability of each outcome cannot be independently verified from the available data. Treat the exploitability assessment as derived from the CVSS vector and the vulnerability class rather than from observed exploitation.

Impact Assessment

The CVSS base score of 8.8 with subscores C:H/I:H/A:H indicates that successful exploitation can cause severe damage across all three security objectives. The availability impact is immediate: Junos OS Evolved telemetry services can be disrupted, degrading operational visibility for network operators and telemetry-dependent monitoring and automation pipelines. The confidentiality impact is material: information disclosure from a network operating system's management daemon could expose device configuration, topology data, or credentials depending on what the leaked memory contains.

The most severe outcome is potential root-level code execution within the gRPC daemon. On a router or switch running the network operating system, root-level code execution on the control plane is a high-blast-radius condition. A compromised device can be reconfigured, used as a pivot point into the management network, or positioned for traffic interception depending on the platform role. However, exploitation is gated by PR:L and AV:N — the attacker must already be authenticated to gNMI. This makes CVE-2026-101965 primarily relevant to insider-risk, compromised-credential, and multi-stage scenarios rather than opportunistic internet-wide scanning, though authenticated scanning against exposed gNMI endpoints remains plausible if credentials leak.

Affected systems are Juniper Networks platforms running Junos OS Evolved with the gRPC daemon and gNMI service enabled and reachable. The exact affected version range is not published in the available data, so all deployments with the gNMI service exposed should be treated as potentially affected until the vendor clarifies. Exploitation requires no user interaction, so an authorized attacker can trigger the flaw on demand with a single crafted message.

Detection Guidance

Sigma Rule

title: Potential Format String Injection Against Junos OS Evolved gNMI Service
id: 8f2a1c74-3b9e-4d51-a6c2-9e0f7d4b2a11
status: experimental
description: Detects gNMI/gRPC request payloads containing format-string conversion specifiers that may indicate exploitation attempts against CVE-2026-101965 in Juniper Junos OS Evolved.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101965
author: valtersit.com
date: 2026-01-01
logsource:
  category: network_connection
  product: zeek
detection:
  selection_proto:
    proto: 'tcp'
    service: 'grpc'
  selection_payload:
    - payload|contains:
        - '%n'
        - '%s%'
        - '%x%'
        - '%p%'
        - '%hhn'
        - '%hn'
  condition: selection_proto and selection_payload
falsepositives:
  - Legitimate gNMI payloads containing percent characters in path or value fields
  - Fuzzing or protocol conformance testing tools
level: high
tags:
  - attack.t1190
  - cve.2026-101965

YARA Rule

rule CVE_2026_101965_Junos_gNMI_FormatString
{
    meta:
        description = "Detects format-string conversion specifiers in gNMI/gRPC payloads potentially targeting CVE-2026-101965 in Juniper Junos OS Evolved gRPC daemon"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101965"
        severity = "high"

    strings:
        $fmt1 = "%n" ascii
        $fmt2 = "%hn" ascii
        $fmt3 = "%hhn" ascii
        $fmt4 = "%s%n" ascii
        $fmt5 = "%x%n" ascii
        $fmt6 = "%p%n" ascii
        $gnmi1 = "gnmi" ascii nocase
        $gnmi2 = "SubscribeRequest" ascii nocase
        $gnmi3 = "GetRequest" ascii nocase

    condition:
        uint16(0) == 0x0A0D and
        (
            any of ($fmt*) and any of ($gnmi*)
        )
        or
        (
            all of ($fmt*) and filesize < 100KB
        )
}

Suricata IDS Rule

alert tcp any any -> any 9339 (msg:"CVE-2026-101965 Juniper Junos OS Evolved gNMI Format String Injection Attempt"; flow:established,to_server; dsize:>0; content:"%n"; nocase; content:"%s"; nocase; within:64; sid:2026101965; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-101965, affected_product Juniper_Junos_OS_Evolved, mitre_tactic_technique T1190; classtype:attempted-admin; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101965;)

Elastic Detection

network where
  destination.port == 9339 and
  process.name == "grpc" and
  network.protocol == "grpc"
  and
  (
    network.bytes > 0 and
    (
      string(network.payload).contains("%n") or
      string(network.payload).contains("%hn") or
      string(network.payload).contains("%hhn")
    )
  )

Splunk SPL Query

index=network sourcetype=suricata OR sourcetype=zeek_conn
| search dest_port=9339 OR service=grpc
| regex payload="%[0-9]*[nsxhhnp]"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip dest_port
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="junos,grpc,cve-2026-101965">
  <rule id="2026101" level="12">
    <decoded_as>json</decoded_as>
    <field name="proto">tcp</field>
    <field name="dest_port">9339</field>
    <match>%n|%hn|%hhn|%s%n|%x%n</match>
    <description>CVE-2026-101965: Potential gNMI format string injection attempt against Junos OS Evolved gRPC daemon</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,t1190,exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No vendor patch, fixed version, or official workaround has been identified from any tracked source. The guidance below reflects defensive actions appropriate to an unpatched CWE-134 vulnerability in a network management daemon.

1. Immediate mitigations:

• Restrict network access to the gNMI/gRPC service on Junos OS Evolved devices. Apply management-plane firewall filters or ACLs so that only explicitly trusted management hosts can reach the gNMI listener. This directly addresses the network attack vector (AV:N).
• Audit and minimize the set of accounts and credentials authorized for gNMI access. Because the flaw requires only low privileges (PR:L), any credential reaching gNMI can potentially trigger it. Rotate gNMI credentials and enforce least-privilege authorization profiles.
• Disable the gNMI service where it is not operationally required. A disabled service is not reachable and eliminates the attack surface.
• Monitor telemetry-service health for unexpected daemon restarts, crashes, or gaps in streaming telemetry, which may indicate exploitation attempts.

2. Patch/upgrade steps:

• There is currently no confirmed fixed version. Monitor Juniper Networks security advisories and the NVD entry for CVE-2026-101965 for an official patch release. Do not assume applicability of any version threshold until the vendor publishes one.
• When a fixed release becomes available, prioritize upgrade of internet- or management-network-exposed Junos OS Evolved systems with gNMI enabled, then schedule the remainder per standard maintenance windows.

3. Long-term hardening:

• Treat network management and telemetry interfaces (gNMI, gRPC, NETCONF, and similar) as high-value control-plane attack surface. Segment them into dedicated management networks with strict east-west controls.
• Enforce strong authentication and certificate-based authorization for gNMI endpoints, and integrate gNMI access logging into the SOC.
• Establish continuous monitoring of vendor advisories for Junos OS Evolved and maintain a tested, repeatable upgrade process so that patch application is not bottlenecked when a fix is published.
• Where supported, run management daemons with the least privilege required and monitor for anomalous behavior from the gRPC daemon process.

References

• NVD — CVE-2026-101965: https://nvd.nist.gov/vuln/detail/CVE-2026-101965
• CWE-134 — Use of Externally-Controlled Format String: https://cwe.mitre.org/data/definitions/134.html
• Juniper Networks Security Advisories (vendor advisory — monitor for CVE-2026-101965): https://supportportal.juniper.net/s/global-search/%40uri
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-101965 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns and no exploit-in-the-wild evidence have been identified for CVE-2026-101965 in the available data. No public PoC or exploit code is known.