Juniper Networks Junos Os Evolved vulnerabilities

CVE-2026-101983 Critical · 9.8 CWE-121 Oct 14, 2026

Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured

A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.

CVE-2026-101982 Critical · 9.8 CWE-121 Oct 14, 2026

Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.

CVE-2026-101981 High · 8.8 CWE-121 Oct 14, 2026

Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when LDP is enabled

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.

CVE-2026-101979 High · 8.8 CWE-121 Oct 14, 2026

Junos OS and Junos OS Evolved: A network attacker causes root-level code execution or denial of service when SNMP and AAA are enabled

A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled.

CVE-2026-101976 High · 7.5 CWE-787 Oct 14, 2026

Junos OS and Junos OS Evolved: In a non-4byte-AS scenario a specific BGP update causes an rpd crash

An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS).

CVE-2026-101975 Medium · 6.5 CWE-617 Oct 14, 2026

Junos OS and Junos OS Evolved: Improper OSPF LSA validation causes an rpd crash when prefix-SID best-route installation is used

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured.

CVE-2026-101972 Medium · 6.5 CWE-190 Oct 14, 2026

Junos OS and Junos OS Evolved: Malformed OSPF packets causes routing disruption when OSPF is enabled

An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface.

CVE-2026-101964 Medium · 6.5 CWE-617 Oct 14, 2026

Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP message

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session.

CVE-2026-101963 High · 7.5 CWE-682 Oct 14, 2026

Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used

An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.

CVE-2026-101962 High · 7.5 CWE-130 Oct 14, 2026

Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used

An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash.

CVE-2026-101961 High · 7.5 CWE-476 Oct 14, 2026

Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when an ECMP qualifier is used in an import policy

A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy.

CVE-2026-101959 Medium · 6.5 CWE-688 Oct 14, 2026

Junos OS and Junos OS Evolved: A malformed LSP-ping causes an rpd crash

A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping.

CVE-2026-101954 Critical · 9.8 CWE-287 Oct 14, 2026

Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled

An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.

CVE-2026-101952 High · 7.5 Oct 14, 2026

Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabled

An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR.

CVE-2026-101949 High · 7.5 CWE-476 Oct 14, 2026

Junos OS and Junos OS Evolved: In a scenario with VPN-flowspec and BMP monitoring a specific BGP update causes an rpd crash

A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured.

CVE-2026-33796 Critical · 9.8 CWE-121 Oct 14, 2026

Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.

CVE-2026-33798 High · 8.8 CWE-121 Oct 14, 2026

Junos OS and Junos OS Evolved: SRX Series: An attacker causes remote code execution when SRX chassis-cluster is enabled

A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic.

CVE-2026-33795 High · 7.5 CWE-197 Oct 14, 2026

Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP Prefix-SID routes are re-advertised

A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised. This issue does not affect versions of Junos OS prior to 20.4R1. This issue does not affect versions of Junos OS Evolved prior to 20.4R1-EVO

CVE-2026-33789 Critical · 9.8 CWE-121 Oct 14, 2026

Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in denial of service

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.

CVE-2026-103993 Medium · 6.8 CWE-787 Oct 14, 2026

Junos OS and Junos OS Evolved: If a specific set of BGP communities is present and graceful-shutdown sender is added while attempting to advertise rpd crashes

An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker which sends a specific set of BGP communities to cause a Denial-of-Service (DoS) as rpd crashes when graceful-shutdown sender community is added when attempting to advertise.

CVE-2026-102185 High · 7.5 CWE-835 Oct 14, 2026

Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when EVPN multihoming preference-based DF election is used

A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election.

CVE-2026-102184 High · 7.5 CWE-1284 Oct 14, 2026

Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crash

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update. The result is a denial of service affecting routing adjacencies.

CVE-2026-102183 High · 7.5 CWE-1284 Oct 14, 2026

Junos OS and Junos OS Evolved: If in a BGP EVPN scenario a malformed NLRI is received rpd crashes

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP EVPN peer to cause an rpd crash via a specifically malformed NLRI.

CVE-2026-102175 Critical · 9.8 CWE-122 Oct 14, 2026

Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is used

A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection.

CVE-2026-102180 High · 7.5 CWE-121 Oct 14, 2026

Junos OS and Junos OS Evolved: An attacker causes an rpd crash when BGP RIB streaming telemetry is in use

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active. This issue does not affect Junos OS versions prior to 22.1R1. This issue does not affect Junos OS Evolved versions prior to 22.1R1-EVO.