{"affected":[{"defaultStatus":"unaffected","product":"Junos OS Evolved","source":"CNA: juniper","vendor":"Juniper Networks","versions":[{"lessThan":"24.4R2-S5-EVO","status":"affected","version":"24.4","versionType":"custom"},{"lessThan":"25.2R2-S2-EVO","status":"affected","version":"25.2","versionType":"custom"},{"lessThan":"25.4R1-S3-EVO","status":"affected","version":"25.4","versionType":"custom"},{"lessThan":"26.2R1-S2-EVO","status":"affected","version":"26.2","versionType":"custom"},{"status":"affected","version":"23.4X100","versionType":"custom"},{"lessThan":"25.2X100-D35-EVO","status":"affected","version":"25.2X100","versionType":"custom"},{"lessThan":"25.4X300-D40-EVO","status":"affected","version":"25.4X300","versionType":"custom"}]}],"cveId":"CVE-2026-101967","cwes":["CWE-78"],"description":"An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.","epss":{"date":"2026-11-03","percentile":0.90355,"score":0.0392},"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: juniper","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":9.3,"severity":"critical","source":"CNA: juniper","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H","version":"4.0"}],"modifiedAt":1793751442172,"publishedAt":1791994512683,"references":[{"source":"CNA: juniper","tags":["vendor-advisory"],"url":"https://supportportal.juniper.net/JSA112250"}],"remediation":[{"kind":"fix","source":"CNA: juniper","text":"The following software releases have been updated to resolve this specific issue:\n\nJunos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases.\n\nNote: For Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."},{"kind":"workaround","source":"CNA: juniper","text":"There are no known workarounds for this issue."}],"revision":"3a4ea045993ecbca0fccc239043d99705bf54f28c3f21cffd31a7551b10bafd0","sources":[{"modifiedAt":1793751442172,"name":"CNA: juniper","retrievedAt":1793754644568,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101967"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793748164050,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101967"}],"ssvc":{"assessedAt":1792036639006,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used","updatedAt":1793754644568}