A NULL Pointer Dereference vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker setting or deactivating a specific SSH configuration parameter to create a Denial of Service (DoS).

A local high-privileged user configuring or deactivating a specific 'system services ssh' configuration parameter can exploit a null pointer dereference in one of the functions used by SSH. The function attempts to dereference a null pointer when accessing certain configuration data, resulting in an mgd process crash and restart. Continued execution of these configuration commands will create a sustained Denial of Service (DoS) condition.

This issue affects:
Junos OS:

• from 22.3 before 22.3R3-S5;
• from 22.4 before 22.4R3-S10;
• from 23.2 before 23.2R2-S7;
• from 23.4 before 23.4R2-S8.

This issue does not affect Junos OS before 22.3R1.

Junos OS Evolved:

• from 22.3R1-EVO before 23.2R2-S7-EVO;
• from 23.4 before 23.4R2-S8-EVO.

This issue does not affect Junos OS Evolved before 22.3R1-EVO.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was discovered during external security research.

This issue has been assigned CVE-2026-21901.

The following software releases have been updated to resolve this specific issue:
Junos OS: 22.3R3-S5, 22.4R3-S10, 23.2R2-S7, 23.4R2-S8, 24.2R1, and all subsequent releases.
Junos OS Evolved: 23.2R2-S7-EVO, 23.4R2-S8-EVO, 24.2R1-EVO, and all subsequent releases.

This issue is being tracked as 1779319 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

There are no direct workarounds for this issue.

One of the following mitigations will prevent malicious exploitation:

• Use access lists or firewall filters to limit access to the CLI only from trusted hosts and administrators.
• Utilize command authorization to limit the ability to enter config mode to trusted administrators.

2026-07-08: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• github.com/orangecertcc/security-research/security/advisories/GHSA-g4f7-w2rc-hpj6

Juniper SIRT would like to acknowledge and thank Orange CERT-CC from the Orange group for responsibly reporting this vulnerability.