This KB provides a platform-wide impact assessment for all Junos OS and Junos OS Evolved devices across supported releases regarding multiple OpenSSH vulnerabilities .
The following CVEs were evaluated:
CVE-2026-35385 – SCP setuid/setgid bit preservation
CVE-2026-35386 – Shell metacharacter injection via %-tokens
CVE-2026-35387 – Unintended ECDSA algorithm acceptance
CVE-2026-35388 – Missing confirmation for proxy-mode multiplexing
CVE-2026-35414 – Certificate principal name confusion via comma handling
Customers may review upstream OpenSSH 10.3 advisories and question whether Junos OS or Junos OS Evolved devices are affected by these CVEs.
CVE Assessment Summary
CVE-2026-35385 - SCP setuid/setgid bit preservation
Junos & EVO: NOT IMPACTED
The SCP legacy protocol preserves setuid/setgid bits on transferred files (confirmed reproducible). However, privilege escalation is blocked by platform integrity enforcement:
- Junos: veriexec blocks execution of unsigned binaries. Setuid scripts are ignored by the FreeBSD kernel.
- EVO: IMA blocks execution of unsigned binaries. Setuid scripts are ignored by the Linux kernel.
CVE-2026-35386 - Shell metacharacter injection via %-tokens
Junos & EVO: NOT AFFECTED
Affected directives (Match exec, ProxyCommand, LocalCommand, KnownHostsCommand, RemoteCommand) are SSH client-side directives not exposed through the Junos CLI. Not present in shipped ssh_config.
CVE-2026-35387 - Unintended ECDSA algorithm acceptance
PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms are not configurable via CLI. All three ECDSA curves are accepted by default.
CVE-2026-35388 - Missing confirmation for proxy-mode multiplexing
SSH multiplexing (ControlMaster/ControlPath) is not used or configurable on either platform. The vulnerable code path is never reached.
CVE-2026-35414 - Certificate principal name confusion via comma handling
CLI-configured public keys are written as plain keys in authorized_keys - no support for cert-authority or principals="..." options. The vulnerable matching logic is never invoked.
Summary:
CVE-2026-35385: Not impacted
CVE-2026-35386: Not affected
CVE-2026-35387: Not affected
CVE-2026-35388: Not affected
CVE-2026-35414: Not affected
No customer action required. All five CVEs are either not affected (feature not exposed) or not impacted (platform integrity controls prevent exploitation).