Junos OS Evolved bootzd on PTX: crafted gRPC provisioning response executes commands as root

CVSS 8.7CVE-2026-101978Firmware, BMC & network fabriccurated

Impact

A second command injection in the same provisioning daemon, this one reached through the gRPC (secure ZTP) response path on PTX Series routers rather than DHCP. An attacker on the management LAN who can stand in for the provisioning server gets root command execution on the device. PTX boxes sit in the spine of large AI fabrics and on datacenter interconnect, so a compromised one gives an attacker a vantage point over traffic between pods and between sites, plus the ability to black-hole links during a training run. The fix and the advisory are shared with the DHCP variant, but the trigger is a different protocol path, so an operator mitigating only DHCP is still exposed.

Who can reach it

Adjacent network: an attacker able to impersonate or intercept the ZTP gRPC provisioning server on the management LAN. No authentication required.

What to do

Upgrade to the Junos OS Evolved release listed in JSA112250, which requires a reboot and therefore a maintenance window per spine device. Interim mitigation is to disable secure ZTP where it is not in use and to restrict the management network so only the real provisioning server is reachable. Fixed versions are not in this record - see JSA112250.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101978 https://supportportal.juniper.net/JSA112250

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.