Description

This KB provides a platform-wide impact assessment for all Junos OS and Junos OS Evolved devices across supported releases regarding multiple OpenSSH vulnerabilities .


The following CVEs were evaluated:


CVE-2026-35385 – SCP setuid/setgid bit preservation

CVE-2026-35386 – Shell metacharacter injection via %-tokens

CVE-2026-35387 – Unintended ECDSA algorithm acceptance

CVE-2026-35388 – Missing confirmation for proxy-mode multiplexing

CVE-2026-35414 – Certificate principal name confusion via comma handling

Symptoms

Customers may review upstream OpenSSH 10.3 advisories and question whether Junos OS or Junos OS Evolved devices are affected by these CVEs.

Solution

CVE Assessment Summary


CVE-2026-35385 - SCP setuid/setgid bit preservation

Junos & EVO: NOT IMPACTED


The SCP legacy protocol preserves setuid/setgid bits on transferred files (confirmed reproducible). However, privilege escalation is blocked by platform integrity enforcement:

- Junos: veriexec blocks execution of unsigned binaries. Setuid scripts are ignored by the FreeBSD kernel.

- EVO: IMA blocks execution of unsigned binaries. Setuid scripts are ignored by the Linux kernel.


CVE-2026-35386 - Shell metacharacter injection via %-tokens

Junos & EVO: NOT AFFECTED


Affected directives (Match exec, ProxyCommand, LocalCommand, KnownHostsCommand, RemoteCommand) are SSH client-side directives not exposed through the Junos CLI. Not present in shipped ssh_config.


CVE-2026-35387 - Unintended ECDSA algorithm acceptance

Junos & EVO: NOT AFFECTED


PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms are not configurable via CLI. All three ECDSA curves are accepted by default.


CVE-2026-35388 - Missing confirmation for proxy-mode multiplexing

Junos & EVO: NOT AFFECTED


SSH multiplexing (ControlMaster/ControlPath) is not used or configurable on either platform. The vulnerable code path is never reached.


CVE-2026-35414 - Certificate principal name confusion via comma handling

Junos & EVO: NOT AFFECTED


CLI-configured public keys are written as plain keys in authorized_keys - no support for cert-authority or principals="..." options. The vulnerable matching logic is never invoked.


Summary:

CVE-2026-35385: Not impacted

CVE-2026-35386: Not affected

CVE-2026-35387: Not affected

CVE-2026-35388: Not affected

CVE-2026-35414: Not affected


No customer action required. All five CVEs are either not affected (feature not exposed) or not impacted (platform integrity controls prevent exploitation).




Modification History

2026-05-07 : Article Created