CVE-2026-21901: Juniper Junos OS Management Daemon DoS via SSH Config

Technical summary

CVE-2026-21901 is a NULL pointer dereference (CWE-476) in the management daemon (mgd) of Juniper Junos OS and Junos OS Evolved. When a high-privileged local user sets or deactivates a specific SSH configuration parameter via 'system services ssh', the SSH subsystem function fails to validate that a pointer is valid before dereferencing it. This results in a segmentation fault, crashing mgd and triggering an automatic restart. Repetitive execution of the problematic configuration command sustains a denial-of-service condition, preventing legitimate administrative operations until the offending configuration is corrected.

Business impact

This vulnerability creates a management plane outage risk for organizations running affected Junos versions. A disgruntled or compromised high-privileged administrator could repeatedly crash the management daemon, blocking legitimate configuration changes, monitoring, and troubleshooting until the issue is mitigated. While the vulnerability requires local access and administrative credentials, it can temporarily disable critical administrative functions on production routers and firewalls. Organizations dependent on continuous management access should prioritize patching to avoid potential operational disruption.

Affected systems

Junos OS versions 22.3 (before 22.3R3-S5), 22.4 (before 22.4R3-S10), 23.2 (before 23.2R2-S7), and 23.4 (before 23.4R2-S8) are affected. Junos OS Evolved is affected in versions 22.3R1-EVO through 23.2R2-S7-EVO and 23.4 before 23.4R2-S8-EVO. Junos OS versions prior to 22.3R1 and Junos OS Evolved prior to 22.3R1-EVO are not vulnerable. Verify your running Junos version to determine exposure.

Exploitability

Exploitation requires local access and high-privilege credentials (typically a system administrator role). The attacker must have the ability to issue configuration commands via SSH or console access. There is no remote exploitation vector. The technical barrier to triggering the crash is low—a single malformed or deactivated SSH configuration parameter is sufficient. However, the privilege requirement significantly limits the threat surface to internal actors or external attackers who have already compromised an administrative account.

Remediation

Upgrade to a patched Junos OS release: 22.3R3-S5 or later for the 22.3 branch, 22.4R3-S10 or later for 22.4, 23.2R2-S7 or later for 23.2, or 23.4R2-S8 or later for 23.4. For Junos OS Evolved, upgrade to 23.2R2-S7-EVO or 23.4R2-S8-EVO or later. Until patching is possible, restrict SSH configuration changes to trusted administrators, monitor mgd process restarts for anomalies, and maintain current backups of running configurations to facilitate rapid recovery if the issue occurs.

Patch guidance

Juniper has released patched versions across all affected major releases. Identify your current Junos version using 'show version' from operational mode. Plan a maintenance window for the upgrade, as Junos OS updates typically require a reboot. Test patches in a non-production environment first to ensure compatibility with your deployed features and scripts. Juniper's security advisories will contain specific version numbers and any known issues with each patch release; consult those before deployment. Prioritize systems in critical paths where management daemon availability directly impacts network operations.

Detection guidance

Monitor Junos syslog for repeated mgd process restarts and crashes, particularly correlating with SSH configuration change attempts. Enable debugging on the SSH subsystem if investigating suspected exploitation. Audit user accounts with high-privilege SSH access and review configuration change logs for suspicious or repeated attempts to modify 'system services ssh' parameters. Network-based detection is limited since the attack vector is local; focus on endpoint logging and access controls to identify unauthorized administrative activity.

Why prioritize this

Although the CVSS score is moderate (4.4) and the vulnerability requires high-privilege local access, the management plane impact and simplicity of triggering a sustained denial of service make this worth prioritizing in patch cycles. The vulnerability is not in the publicly disclosed KEV catalog, but organizations should still address it to protect against insider threats and compromised administrator accounts. The fix is available and straightforward to deploy, reducing deployment risk.

Risk score, explained

The CVSS v3.1 score of 4.4 (MEDIUM) reflects the combination of local-only attack vector, high privilege requirement, low complexity, and high availability impact with no confidentiality or integrity breach. While the score is not critical, the ability to disable management access on network infrastructure devices elevates business risk beyond the numerical score alone. Organizations should weigh this against their tolerance for management plane disruptions and the maturity of their insider-threat programs.

Frequently asked questions