CVE-2026-102085

Awaiting Analysis Awaiting Analysis - Queue

Information Disclosure in Juniper Networks Junos OS Evolved

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Juniper Networks, Inc.

Description

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device. Due to a wrong initialization, a process which should only be able to communicate internally within the device can be reached over the network via an open port. This leads to a device being inadvertently exposed and increased CPU cycles spent processing ingress packets. This issue affects Junos OS Evolved: * All versions before 23.2R2-S7.7-EVO; * 23.4 versions before 23.4R2-S8.11-EVO; * 24.2 versions before 24.2R2-S5.6-EVO; * 24.4 versions before 24.4R2-S4-EVO; * 25.2 version before 25.2R2-S1-EVO; * 25.4 versions before 25.4R1-S1-EVO. Please note that this issue is similar to but not identical CVE-2026-33803.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102085

EUVD

EUVD-2026-101456

Affected Vendors & Products

Vendor	Product	Version / Range
Juniper	Networks	Junos OS Evolved 0
Juniper	Networks	Junos OS Evolved 23.4
Juniper	Networks	Junos OS Evolved 24.2
Juniper	Networks	Junos OS Evolved 24.4
Juniper	Networks	Junos OS Evolved 25.2
Juniper	Networks	Junos OS Evolved 25.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-923	The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Attack-Flow Graph

Executive Summary

This vulnerability in Juniper Networks Junos OS Evolved is an Improper Restriction of Communication Channel to Intended Endpoints issue. It allows an unauthenticated attacker on the network to access a process that should only communicate internally. This happens due to incorrect initialization, exposing the device via an open port and causing increased CPU usage from processing unnecessary packets.

Detection Guidance

This vulnerability involves an exposed internal process via an open network port due to incorrect initialization. Detection requires checking for unexpected open ports or services on affected Junos OS Evolved versions. Use commands like 'show system connections' or 'netstat -tuln' to identify unusual network listeners. Verify if any ports are open that should not be externally accessible.

Impact Analysis

The vulnerability can lead to limited information disclosure and reduced availability of the device. Attackers may exploit the exposed process to gather data or consume CPU resources, potentially slowing down or disrupting device operations.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by exposing internal device processes to network access, leading to unauthorized information disclosure and increased resource consumption. Unauthorized network exposure may violate data protection requirements for confidentiality and availability.

Mitigation Strategies

Upgrade Junos OS Evolved to a fixed version: 23.2R2-S7.7-EVO or later, 23.4R2-S8.11-EVO or later, 24.2R2-S5.6-EVO or later, 24.4R2-S4-EVO or later, 25.2R2-S1-EVO or later, or 25.4R1-S1-EVO or later.

Hi! I’m here to help you understand CVE-2026-102085. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70