CVE-2026-57028
published 2026-07-09CVE-2026-57028: An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated…
PriorityP353high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EPSS
0.30%
22.0th percentile
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause license exhaustion.
Due to an incorrect initialization, a process which should only be able to communicate internally within the device, can be reached over the network via an open port. This leads to unauthorized access to the license management.
This issue affects all Junos OS Evolved versions before 23.2R2-EVO.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | junos_os_evolved | < 23.2 | 23.2 |
| juniper | junos_os_evolved | — | — |
| juniper | junos_os_evolved | — | — |
| juniper | junos_os_evolved | — | — |
| juniper | junos_os_evolved | — | — |
| juniper_networks | junos_os_evolved | < 23.2R2-EVO | 23.2R2-EVO |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Juniper Junos OS Evolved up to 23.2R1-EVO License Management improper authorization
vuldb·2026-07-10·CVSS 7.3
CVE-2026-57028 [HIGH] Juniper Junos OS Evolved up to 23.2R1-EVO License Management improper authorization
A vulnerability was found in Juniper Junos OS Evolved up to 23.2R1-EVO. It has been rated as critical. This affects an unknown part of the component License Management. This manipulation causes improper authorization.
This vulnerability is registered as CVE-2026-57028. Remote exploitation of the attack is possible. No exploit is available.
GHSA
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause license exhaustion.
ghsa_unreviewed·2026-07-10
CVE-2026-57028 [MEDIUM] CWE-923 An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause license exhaustion.
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause license exhaustion.
Due to an incorrect initialization, a process which should only be able to communicate internally within the device, can be reached over the network via an open port. This leads to unauthorized access to the license management.
This issue affects all Junos OS Evolved versions before 23.2R2-EVO.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-09
Published