CVE-2026-21919

OVERVIEW CVE-2026-21919 is an Incorrect Synchronization vulnerability affecting Juniper Networks Junos OS and Junos OS Evolved management daemons (mgd). The vulnerability arises when NETCONF sessions are rapidly established and disconnected, causing a locking issue that leaves mgd processes in an unusable state. When sufficient mgd processes are exhausted, the device becomes unmanageable and requires a power cycle for recovery. The vulnerability impacts Junos OS versions 23.4 through 24.4 and corresponding Junos OS Evolved versions, though earlier releases before 23.4R1 are unaffected. SEVERITY The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) with a network-based attack vector, low attack complexity, and low privilege requirements. The attack requires no user interaction and results in high availability impact through complete denial of service of the management plane. While the confidentiality and integrity of data remain unaffected, the operational impact is severe as administrators lose the ability to manage affected devices. The EPSS score of 0.00045 indicates this vulnerability is not yet widely exploited in the wild. EXPLOITATION STATUS There is no evidence of active exploitation, and this vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog. The Faucet Risk Score of 35.0/100 reflects low immediate threat, and the vulnerability remains inactive on community hotlists. No public exploit code availability has been documented, though the attack method is relatively straightforward for authenticated attackers with low privileges.