Medium 4.4Published Jul 9, 2026

CVE-2026-21901Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash

Updated under an hour ago (Oct 27, 2026, 12:30 AM ET)

Does this affect you?

It affects Juniper Networks Junos OS and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Juniper Networks Junos OS

Exploited in the last 30 days

A NULL Pointer Dereference vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker setting or deactivating a specific SSH configuration parameter to create a Denial of Service (DoS). A local high-privileged user configuring or deactivating a specific 'system services ssh' configuration parameter can exploit a null pointer dereference in one of the functions used by SSH. The function attempts to dereference a null pointer when accessing certain configuration data, resulting in an mgd process crash and restart. Continued execution of these configuration commands will create a sustained Denial of Service (DoS) condition. This issue affects: Junos OS: * from 22.3 before 22.3R3-S5; * from 22.4 before 22.4R3-S10; * from 23.2 before 23.2R2-S7; * from 23.4 before 23.4R2-S8. This issue does not affect Junos OS before 22.3R1. Junos OS Evolved: * from 22.3R1-EVO before 23.2R2-S7-EVO; * from 23.4 before 23.4R2-S8-EVO. This issue does not affect Junos OS Evolved before 22.3R1-EVO.

CVSS: 4.4 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: juniper
NVD analysis: Analyzed
Record last updated: Jul 10, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Juniper Networks Junos OS juniper_networks:junos_os (from the name)	from 22.3 before 22.3R3-S5; from 22.4 before 22.4R3-S10; from 23.2 before 23.2R2-S7; from 23.4 before 23.4R2-S8; before 22.3R1 not affected	CNA record
Juniper Networks Junos OS Evolved juniper_networks:junos_os_evolved (from the name)	from 23.2 before 23.2R2-S7-EVO; from 23.4 before 23.4R2-S8-EVO; before 22.3R1-EVO not affected	CNA record
juniper junos juniper:junos	22.3; 22.3; 22.3; 22.3; 22.3; 22.3; 22.3; 22.3; and 43 more ranges	NVD
juniper junos_os_evolved juniper:junos_os_evolved	22.3; 22.3; 22.3; 22.3; 22.3; 22.3; 22.3; 22.3; and 45 more ranges	NVD

References

References

https://github.com/orangecertcc/security-research/security/advisories/GHSA-g4f7-w2rc-hpj6	third-party-advisory, mitigation, exploit
https://supportportal.juniper.net/JSA110072	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.