High severity · published Oct 14, 2026
CVE-2026-101966
Junos OS Evolved: A crafted analytics sensor resource causes telemetry dial-out daemon denial of service
8.2
CVSS
0.4%
EPSS
No
On KEV
Description
A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JO
Junos OS Evolved · Juniper Networks
25.4 before 25.4R1-S3-EVO; 26.2 before 26.2R1-S2-EVO; 23.4X100; 25.2X100 before 25.2X100-D35-EVO; 25.4X300 before 25.4X300-D40-EVO · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101966
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101966
vendor-advisory
https://supportportal.juniper.net/JSA112250
More from Junos OS Evolved
9.8
CVE-2026-101954
Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled
9.8
CVE-2026-101983
Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured
9.8
CVE-2026-101982
Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used
9.8
CVE-2026-33796
Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled
9.8
CVE-2026-33789
Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in denial of service