CVE-2026-57032: Juniper EX Series gRPC Telemetry Denial-of-Service Vulnerability

Technical summary

CVE-2026-57032 is an improper parameter handling flaw in the packet forwarding engine (pfe) of Juniper Junos OS. The vulnerability stems from inadequate validation of gRPC telemetry subscription requests directed at unsupported sensor paths. When an authenticated attacker subscribes to a non-existent telemetry sensor, the agentd process fails to properly handle the undefined parameter, triggering an AGENTD_RESOURCE_NOT_FOUND condition that cascades to an FPC crash. The underlying issue is categorized as CWE-236 (Improper Handling of Undefined Parameters).

Business impact

Successful exploitation causes complete loss of switching fabric on affected devices, resulting in a denial of service that persists until the FPC module automatically restarts—typically several minutes of downtime. For organizations operating EX Series switches as core or distribution layer devices, this translates to potential network segment isolation or traffic blackholing. Since the attack requires only low-privilege authenticated access (such as a monitoring user with gRPC read permissions), the threat model includes insider threats and compromised monitoring systems.

Affected systems

Juniper Junos OS on EX2300, EX2300-C, EX3400, EX4000, EX4100, and EX4400 devices are affected. Vulnerable versions span multiple release trains: all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S8, 24.2 versions before 24.2R2-S5, and 24.4 versions before 24.4R2. Organizations should cross-reference their current Junos OS version and model against these baselines to determine exposure.

Exploitability

The attack requires network access to the gRPC telemetry endpoint and valid authentication credentials with telemetry subscription privileges. No user interaction is needed, and the attack is repeatable on demand. The low complexity and low privilege requirements place this well within reach of compromised service accounts, rogue administrators, or lateral movement attacks targeting monitoring infrastructure. The publicly disclosed nature of the vulnerability (published 2026-07-09) means threat actors have clear guidance on how to trigger the condition.

Remediation

Apply vendor security patches to move to patched Junos OS versions: 23.2R2-S7 or later, 23.4R2-S8 or later, 24.2R2-S5 or later, or 24.4R2 or later, depending on your current release train. Verify against the official Juniper security advisory for your specific device model and current OS version before applying patches in production.

Patch guidance

Coordinate patching with your change management process and maintenance windows, as Junos OS upgrades typically require device restart. Test patches in a lab environment on equivalent hardware if possible. Juniper provides modular patch releases (indicated by the R/S versioning scheme) that allow targeted updates. Prioritize patching for devices at network boundaries or in critical data paths. Maintain current backups of device configurations before initiating upgrades.

Detection guidance

Monitor Junos OS syslog output for AGENTD_RESOURCE_NOT_FOUND error messages, which indicate subscription attempts to invalid telemetry paths. Track unusual gRPC telemetry subscription patterns, especially from non-standard monitoring clients or at unexpected times. Baseline normal gRPC traffic to your switches and alert on anomalies. Review authenticated user access logs to identify who holds telemetry subscription privileges and audit their usage patterns. Consider restricting gRPC access to management networks and specific source IPs.

Why prioritize this

Although the CVSS score is 6.5 (Medium), the practical risk is elevated by the low authentication barrier, high availability impact, and ease of exploitation. Any organization operating these switches should treat patching as a near-term priority, especially if telemetry is exposed to less-trusted networks or service accounts. The attack is not gaining active exploitation credit in KEV tracking, but that status should be re-evaluated as awareness spreads.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-reachable attack with low privilege requirements and high availability impact (complete FPC crash), but no confidentiality or integrity compromise. The score appropriately captures the denial-of-service nature. However, context matters: an internal attacker or compromised monitoring tool can trigger this repeatedly with minimal detection, potentially causing persistent service instability. Organizations should consider risk amplification in threat models where telemetry endpoints are accessible to less-trusted users.

Frequently asked questions