Loading story…
Juniper Networks disclosed CVE-2025-13914, a high-severity flaw in Apstra that fails to validate SSH host keys when the Apstra server connects outbound to managed network devices. The weakness, tracked as CWE-322 and rated CVSS 8.7, allows an on-path attacker to impersonate a legitimate device during the SSH handshake, intercept credentials, and potentially obtain administrative access to network infrastructure managed through Apstra’s automation and telemetry plane.
The issue affects all Apstra versions before 6.1.1, and Juniper said there is no workaround. The company fixed the vulnerability in Apstra 6.1.1 under internal ID AOS-56131 and published advisory JSA107862; at disclosure, Juniper said it was not aware of malicious exploitation. Separate Juniper reporting also highlighted another SSH-related risk in Junos OS VM Host tracked as CVE-2025-52983, where previously configured root public keys could remain valid over SSH despite being shown as disabled in the interface, underscoring broader exposure from SSH trust and authentication failures in Juniper-managed environments.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Juniper fixed CVE-2025-13914 in Apstra version 6.1.1 under internal tracking ID AOS-56131. The flaw could let an on-path attacker impersonate managed devices during SSH handshakes and capture credentials.
Juniper Networks published security advisory JSA107862 for CVE-2025-13914, a high-severity Apstra vulnerability caused by missing SSH host key validation in outbound connections to managed devices. Juniper said no malicious exploitation was known at disclosure time.
Juniper Networks released patches for CVE-2025-52983 in Junos OS to ensure that disabling root SSH public key authentication is actually enforced. The vulnerability affected VM Host systems and could allow attackers with a previously configured private key to authenticate as root over SSH.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
supportportal.juniper.net
Open sourcezeropath.com
Open sourcezeropath.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Juniper disclosed two security vulnerabilities affecting **Junos OS** and **Junos OS Evolved**, including a local privilege-escalation flaw tracked as **`CVE-2026-21916`** that allows a low-privileged user to escalate privileges and log in as **`root`**. The issue creates a path for attackers who already have limited access to gain full administrative control over affected devices, increasing the risk of device takeover and unauthorized configuration changes. Juniper also published an advisory for **`CVE-2026-21919`**, a denial-of-service condition in **Junos OS** and **Junos OS Evolved** where a high frequency of connecting and disconnecting **NETCONF** sessions can cause management-plane unavailability. The flaw can disrupt administrative access and network operations by making device management unavailable, compounding the impact of the privilege-escalation issue for organizations running affected Juniper infrastructure.
Apr 9, 2026
Juniper Networks disclosed multiple high-severity vulnerabilities in **Junos OS** and **SRX/MX** platforms, including remotely exploitable denial-of-service flaws and local privilege-escalation issues. The most exposed bugs include **`CVE-2026-33790`**, which lets an unauthenticated attacker crash the `srxpfe` packet forwarding engine on **SRX Series** firewalls by sending a malformed **ICMPv6** packet to devices with **NAT64** enabled, and **`CVE-2026-33778`**, which allows a malformed initial **ISAKMP** packet to crash the `kmd` or `iked` daemons on **SRX** and **MX** systems providing IPsec VPN services. Juniper said repeated exploitation can sustain outages by forcing affected processes into crash loops, and that fixes were released through security bulletins including **`JSA107874`** and **`JSA107868`**. Juniper also fixed **`CVE-2026-33785`**, a missing authorization flaw in **MX Series** routers that allows any locally authenticated user to run privileged `request csds` commands and potentially compromise managed infrastructure in **JDM/CSDS** deployments, and **`CVE-2026-21916`**, a symlink-handling bug in the Junos CLI that can let a low-privileged user gain **root** when another user performs a configuration commit. Affected versions span several supported Junos release trains, with fixes issued on April 8, 2026; some older branches, including certain end-of-life releases, do not have patches. Detection guidance from Juniper and Tenable relies largely on version auditing, configuration review for exposed features such as NAT64 and IPsec, and monitoring for daemon crashes, suspicious `file link` activity, unexpected root access, and abuse of privileged management commands.
Jun 29, 2026
Juniper Networks released security updates for multiple vulnerabilities in **Junos OS** and **Junos OS Evolved** that could allow denial of service, bypass of security restrictions, or unauthorized access caused by incorrect initialization. The affected products should be assessed across network infrastructure where Junos software is deployed. Notable issues include **CVE-2026-57026**, a network-reachable, unauthenticated denial-of-service vulnerability rated **CVSS 7.5**, and **CVE-2026-57028**, a network-reachable, unauthenticated access-control vulnerability rated **CVSS 7.3**. Organizations should test and deploy Juniper’s available fixes promptly, prioritizing internet-facing and otherwise untrusted-network-reachable devices.
Sep 27, 2026