CVE-2026-57028
Last modified
CVE-2026-57028 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause license exhaustion. Due to an incorrect initialization, a process which should only be able to communicate internally within the device, can be reached over the network via an open port. This leads to unauthorized access to the license management. This issue affects all Junos OS Evolved versions before 23.2R2-EVO.. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause license exhaustion. Due to an incorrect initialization, a process which should only be able to communicate internally within the device, can be reached over the network via an open port. This leads to unauthorized access to the license management. This issue affects all Junos OS Evolved versions before 23.2R2-EVO.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Juniper | Junos Os Evolved | < 23.2 |
| Juniper | Junos Os Evolved | 23.2 |
References
- https://supportportal.juniper.net/JSA110088Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-57028?
How severe is CVE-2026-57028?
How do I fix CVE-2026-57028?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-57022An Improper Check for Unusual or Exceptional Conditions vuln…8.2
- CVE-2026-57023An Improper Validation of Specified Quantity in Input vulner…8.7
- CVE-2026-57024A Use of Multiple Resources with Duplicate Identifier vulner…6.9
- CVE-2026-57025A Return of Pointer Value Outside of Expected Range vulnerab…6.8
- CVE-2026-57026An Improper Validation of Syntactic Correctness of Input vul…8.7
- CVE-2026-57027A Missing Release of Memory after Effective Lifetime vulnera…7.1
- CVE-2026-57029A Missing Synchronization vulnerability in the flow collecto…6
- CVE-2026-57030A Concurrent Execution using Shared Resource with Improper S…8.2
- CVE-2026-57031An Improper Check for Unusual or Exceptional Conditions vuln…5.3
- CVE-2026-57032An Improper Handling of Undefined Parameters vulnerability i…7.1
- CVE-2026-5704A flaw was found in tar. A remote attacker could exploit thi…5.5
- CVE-2026-5705A vulnerability was identified in code-projects Online Hotel…4.3
Are you affected by CVE-2026-57028?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST