Security readout for executives and security teams
Plain-English summary
CVE-2026-21921 can let a low-privileged authenticated network user crash key Junos telemetry-capable processes by causing repeated telemetry subscription changes over time. Depending on which daemon crashes, routing or chassis management disruption may occur, including a temporary complete outage until recovery.
Executive priority
Prioritize remediation for core, edge, and high-availability network devices using Junos telemetry. Although authentication is required, a low-privileged account could cause meaningful network disruption. Treat this as a high availability risk rather than a data breach indicator.
Technical view
This is a CWE-416 use-after-free in Juniper Junos OS and Junos OS Evolved chassisd, affecting telemetry-capable processes including chassisd, rpd, and mib2d. The issue is network-reachable, low-complexity, requires low privileges, and impacts availability. CVSS v4.0 score is 7.1 High.
Likely exposure
Exposure is limited to affected Junos OS or Junos OS Evolved versions with telemetry collectors able to authenticate and interact with sensor subscriptions. Internet exposure is not required; internal management or telemetry networks may be sufficient if low-privileged credentials exist.
Exploitation context
The source bundle does not report active exploitation, and CISA KEV is false. Abuse requires authentication and sustained telemetry subscription churn. The primary business risk is denial of service on routing or chassis processes, not data theft or code execution.
Researcher notes
Evidence is limited to the CVE record and Juniper advisory references in the provided bundle. No public exploit status or workaround details are provided. Focus validation on affected versions, telemetry access paths, and crash indicators for chassisd, rpd, and mib2d.
Mitigation direction
- Upgrade Junos OS to 22.4R3-S8, 23.2R2-S5, 23.4R2, or later applicable releases.
- Upgrade Junos OS Evolved to 22.4R3-S8-EVO, 23.2R2-S5-EVO, 23.4R2-EVO, or later applicable releases.
- Restrict telemetry access to trusted collectors and accounts.
- Review Juniper advisory JSA106021 for platform-specific guidance and operational caveats.
Validation and detection
- Inventory Junos OS and Junos OS Evolved versions across routing and switching assets.
- Identify devices running affected release trains listed in JSA106021.
- Review telemetry collector accounts, permissions, and source network access.
- Check logs for unexpected chassisd, rpd, or mib2d crashes and restarts.
- Confirm upgraded devices report fixed or later Junos releases.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-21921 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
7.1HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M
Source materials
- CVE List V5 sourceCVE List V5
- https://supportportal.juniper.net/JSA106021CVE reference · vendor-advisory
- https://kb.juniper.net/JSA106021CVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.