CVE-2026-102085— Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker
Quick assessment
Affected
Juniper Networks Junos OS Evolved
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
漏洞描述翻译： Juniper Networks Junos OS Evolved 中存在一个“通信通道限制不当至预期端点”的漏洞。该漏洞允许未经认证的、基于网络的攻击者对设备造成有限的信息泄露和服务可用性影响。 由于初始化错误，本应只能在设备内部进行通信的进程可以通过一个开放的端口被远程访问。这导致设备无意中暴露，并导致CPU在解析入站数据包时消耗更多的资源。 此问题影响以下版本的 Junos OS Evolved： 所有早于 23.2R2-S7.7-EVO 的版本； 早于 23.4R2-S8.11-EVO 的
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1499 · Endpoint Denial of Service T1046 · Network Service DiscoveryAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Juniper Networks | Junos OS Evolved | < 23.2R2-S7.7-EVO |
affected |
23.4< 23.4R2-S8.11-EVO |
affected | ||
24.2< 24.2R2-S5.6-EVO |
affected | ||
24.4< 24.4R2-S4-EVO |
affected | ||
25.2< 25.2R2-S1-EVO |
affected | ||
25.4< 25.4R1-S1-EVO |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102085
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker
Source: CVE Program / CVE List V5
Vulnerability Description
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device.
Due to a wrong initialization, a process which should only be able to communicate internally within the device can be reached over the network via an open port. This leads to a device being inadvertently exposed and increased CPU cycles spent processing ingress packets.
This issue affects Junos OS Evolved:
* All versions before 23.2R2-S7.7-EVO;
* 23.4 versions before 23.4R2-S8.11-EVO;
* 24.2 versions before 24.2R2-S5.6-EVO;
* 24.4 versions before 24.4R2-S4-EVO;
* 25.2 version before 25.2R2-S1-EVO;
* 25.4 versions before 25.4R1-S1-EVO.
Please note that this issue is similar to but not identical CVE-2026-33803.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
通信信道对预期端点的不适当限制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Juniper Networks | Junos OS Evolved | 0 ~ 23.2R2-S7.7-EVO | - |
|
II. Public POCs for CVE-2026-102085
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102085
请登录查看更多情报信息。
Other References for CVE-2026-102085 (1)
-
Article Detail vendor-advisory
Same Patch Batch · Juniper Networks · 2026-10-14 · 153 CVEs total
| CVE-2026-101950 | 9.8 CRITICAL | Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Se |
| CVE-2026-101990 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re |
| CVE-2026-33789 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a speci |
| CVE-2026-33792 | 9.8 CRITICAL | Junos OS: SRX Series: An attacker causes remote code execution and denial of service when |
| CVE-2026-102182 | 9.8 CRITICAL | Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution |
| CVE-2026-33796 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP r |
| CVE-2026-101956 | 9.8 CRITICAL | Junos OS: Unauthorized root command execution when J-Web is enabled |
| CVE-2026-101980 | 9.8 CRITICAL | Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Ech |
| CVE-2026-101986 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution |
| CVE-2026-102178 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malform |
| CVE-2026-101982 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise wh |
| CVE-2026-101983 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual |
| CVE-2026-101954 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover |
| CVE-2026-102175 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of servi |
| CVE-2026-102031 | 9.8 CRITICAL | Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authori |
| CVE-2026-102050 | 8.8 HIGH | Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of |
| CVE-2026-102059 | 8.8 HIGH | Junos OS and Junos OS Evolved: EX Series, SRX Series, QFX Series: A rogue DHCP server caus |
| CVE-2026-102049 | 8.8 HIGH | Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code execution when |
| CVE-2026-102052 | 8.8 HIGH | Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-cl |
| CVE-2026-102176 | 8.8 HIGH | Junos OS: Specific packets cause SDK service crash or Routing Engine compromise when the S |
Showing top 20 of 153 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Junos OS Evolved
-
CVE-2026-102045
Junos OS Evolved: An crafted LACP frame causes lacpd to cras -
CVE-2026-102031
Junos OS Evolved: A low-privileged TACACS+ user causes root -
CVE-2026-102023
Junos OS Evolved: An attacker causes denial of service via S -
CVE-2026-102012
Junos OS Evolved: An attacker causes na-grpcd to crash when -
CVE-2026-101965
Junos OS Evolved: An attacker causes telemetry disruption wh
Same vendor: Juniper Networks
-
CVE-2026-101954
Junos OS and Junos OS Evolved: Unauthenticated network acces -
CVE-2026-101952
Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update -
CVE-2026-101949
Junos OS and Junos OS Evolved: In a scenario with VPN-flowsp -
CVE-2026-101964
Junos OS and Junos OS Evolved: An attacker can cause an rpd -
CVE-2026-101963
Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an
Same weakness: CWE-923
-
CVE-2026-110909
Wheels CLI<=4.1.0端口代理与命令注入漏洞 -
CVE-2026-70212
Windows Security Center Elevation of Privilege Vulnerability -
CVE-2026-85925
Azure Key Vault Client SDK Elevation of Privilege Vulnerabil -
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-102727
FTPD被动数据连接未绑定控制对等体漏洞
V. Comments for CVE-2026-102085
No comments yet