What is CVE-2026-21901?

CVE-2026-21901 is a medium-severity vulnerability in Juniper Junos, classified under NULL Pointer Dereference. CVSS score: 4.4/10. Published 2026-07-09.

How severe is CVE-2026-21901?

Medium severity. CVSS v3 base score is 4.4 out of 10.

NULL pointer dereference in Juniper Junos

CVE-2026-21901

A NULL Pointer Dereference vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker setting or deactivating a specific SSH configuration parameter to create a Denial of Service (DoS). A local high-privileged user configuring or deactivating a specific 'system services ssh' configuration parameter can exploit a null pointer dereference in one of the functions used by SSH. The function attempts to dereference a null pointer when accessing certain configuration data, resulting in an mgd process crash and restart. Continued execution of these configuration commands will create a sustained Denial of Service (DoS) condition. This issue affects: Junos OS: * from 22.3 before 22.3R3-S5; * from 22.4 before 22.4R3-S10; * from 23.2 before 23.2R2-S7; * from 23.4 before 23.4R2-S8. This issue does not affect Junos OS before 22.3R1. Junos OS Evolved: * from 22.3R1-EVO before 23.2R2-S7-EVO; * from 23.4 before 23.4R2-S8-EVO. This issue does not affect Junos OS Evolved before 22.3R1-EVO.

Published 2026-07-09 · last modified 2026-08-26.

CVSS v3 metric

CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.002 (5.3th percentile), scored 2026-10-09.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 5th percentile — 5.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

Juniper Junos — versions 22.3, 22.4, 23.2
Juniper Junos OS Evolved — versions 22.3, 22.4, 23.1
Juniper Networks Junos OS — versions 22.3, 22.4, 23.2
Juniper Networks Junos OS Evolved — versions 23.2, 23.4, 0

Weakness classification (CWE)

CWE-476 — NULL Pointer Dereference

References

github.com/orangecertcc/security-research/security/advisories/GHSA-g4f7-w2rc-hp… (Exploit, Third Party Advisory, Mitigation, third-party-advisory)
supportportal.juniper.net/JSA110072 (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2026-21901?: CVE-2026-21901 is a medium-severity vulnerability in Juniper Junos, classified under NULL Pointer Dereference. CVSS score: 4.4/10. Published 2026-07-09.
How severe is CVE-2026-21901?: Medium severity. CVSS v3 base score is 4.4 out of 10.