High priorityDisclosed

Advisory · CVE-2026-102012

Reachable assertion in Junos OS Evolved telemetry daemon lets anyone crash it over gRPC

A reachable assertion vulnerability in the na-grpcd process of Junos OS Evolved lets a remote unauthenticated attacker cause a denial of service via a gRPC telemetry subscription request. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS Evolved
Identifier / CWE
CVE-2026-102012
CWE-617
Action timing
Immediate
ELI5

Explain it like I’m five

A telemetry subscription, the read-only monitoring path, can assert-crash the daemon with no credentials at all.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Trigger input

    An attacker sends the crafted protocol traffic described for CVE-2026-102012.

  2. 02Weakness trips

    The daemon mishandles the input through the reachable assertion weakness.

  3. 03Impact lands

    The routing or control-plane daemon crashes or misbehaves as described.

What happened

Juniper disclosed CVE-2026-102012 in its October 2026 security release: a reachable assertion vulnerability (CWE-617) in the na-grpcd process of Junos OS Evolved. A remote unauthenticated attacker can deny service with a gRPC telemetry subscription request.

Juniper’s JSA112250 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS Evolved deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS Evolved while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for na-grpcd crashes and telemetry gaps following gRPC subscription requests from unexpected sources.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Telemetry ports are easy to forget in firewall policy. Patch, and confirm gRPC telemetry only listens where collectors live.