Read the docs
TI-2026-74215 Aliases CVE-2026-101990

Stack-based buffer overflow in Junos OS rpd triggered by BGP peers

Priority MEDIUM 49CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

Juniper Networks Junos OS before 23.2R2-S7.7 and Junos OS Evolved before 23.2R2-S7.7-EVO are affected, along with other listed releases. A stack-based buffer overflow (CWE-121) in the routing protocol daemon rpd lets a remote configured BGP peer send a flow-spec update that is selected for re-advertisement, which crashes rpd. On Junos OS the same flaw can allow remote code execution. The attacker needs a configured BGP peer session, with no privileges or user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00568 47th percentileScored 2026-11-07
Fix Fixed Junos OS (Juniper Networks): 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5 +4Junos OS Evolved (Juniper Networks): 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO +6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperJunos OSbefore 23.2R2-S7.7; 23.4 to before 23.4R2-S8.13; 24.2 to before 24.2R2-S5.5; 24.4 to before 24.4R2-S5; 25.2 to before 25.2R2-S2; 25.4 to before 25.4R1-S3; 26.2 to before 26.2R1-S223.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2Patch availableCNA
JuniperJunos OS Evolvedbefore 23.2R2-S7.7-EVO; 23.4 to before 23.4R2-S8.11-EVO; 24.2 to before 24.2R2-S5.6-EVO; 24.4 to before 24.4R2-S5-EVO; 25.2 to before 25.2R2-S2-EVO; 25.4 to before 25.4R1-S3-EVO; 26.2 to before 26.2R1-S2-EVO; 23.4X100; 25.2X100 to before 25.2X100-D35-EVO; 25.4X300 to before 25.4X300-D40-EVO23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 26.2R1-S2-EVO, 25.2X100-D35-EVO, 25.4X300-D40-EVOPatch availableCNA
  • Junos OS VendorJuniper Affected before 23.2R2-S7.7; 23.4 to before 23.4R2-S8.13; 24.2 to before 24.2R2-S5.5; 24.4 to before 24.4R2-S5; 25.2 to before 25.2R2-S2; 25.4 to before 25.4R1-S3; 26.2 to before 26.2R1-S2 Fixed in 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2 Patch available CNA
  • Junos OS Evolved VendorJuniper Affected before 23.2R2-S7.7-EVO; 23.4 to before 23.4R2-S8.11-EVO; 24.2 to before 24.2R2-S5.6-EVO; 24.4 to before 24.4R2-S5-EVO; 25.2 to before 25.2R2-S2-EVO; 25.4 to before 25.4R1-S3-EVO; 26.2 to before 26.2R1-S2-EVO; 23.4X100; 25.2X100 to before 25.2X100-D35-EVO; 25.4X300 to before 25.4X300-D40-EVO Fixed in 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 26.2R1-S2-EVO, 25.2X100-D35-EVO, 25.4X300-D40-EVO Patch available CNA

CPE configurations NVD · 122

CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*up to 23.1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.2:-:*:*:*:*:*:*23.2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1:*:*:*:*:*:*23.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s1:*:*:*:*:*:*23.2 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s2:*:*:*:*:*:*23.2 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2:*:*:*:*:*:*23.2 r2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s1:*:*:*:*:*:*23.2 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s2:*:*:*:*:*:*23.2 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s3:*:*:*:*:*:*23.2 r2-s3VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s4:*:*:*:*:*:*23.2 r2-s4VulnerableJuniper
  • cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:* Versions up to 23.1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.2:-:*:*:*:*:*:* Versions 23.2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.2:r1:*:*:*:*:*:* Versions 23.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s1:*:*:*:*:*:* Versions 23.2 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s2:*:*:*:*:*:* Versions 23.2 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.2:r2:*:*:*:*:*:* Versions 23.2 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s1:*:*:*:*:*:* Versions 23.2 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s2:*:*:*:*:*:* Versions 23.2 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s3:*:*:*:*:*:* Versions 23.2 r2-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s4:*:*:*:*:*:* Versions 23.2 r2-s4 Vulnerable ·Juniper
Show 112 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s5:*:*:*:*:*:*23.2 r2-s5VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s6:*:*:*:*:*:*23.2 r2-s6VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s7:*:*:*:*:*:*23.2 r2-s7VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.4:-:*:*:*:*:*:*23.4VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.4:r1:*:*:*:*:*:*23.4 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s1:*:*:*:*:*:*23.4 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s2:*:*:*:*:*:*23.4 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2:*:*:*:*:*:*23.4 r2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s1:*:*:*:*:*:*23.4 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s2:*:*:*:*:*:*23.4 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s3:*:*:*:*:*:*23.4 r2-s3VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s4:*:*:*:*:*:*23.4 r2-s4VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s5:*:*:*:*:*:*23.4 r2-s5VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s6:*:*:*:*:*:*23.4 r2-s6VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s7:*:*:*:*:*:*23.4 r2-s7VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s8:*:*:*:*:*:*23.4 r2-s8VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:23.4x100:-:*:*:*:*:*:*23.4x100VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.2:-:*:*:*:*:*:*24.2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.2:r1:*:*:*:*:*:*24.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.2:r1-s2:*:*:*:*:*:*24.2 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2:*:*:*:*:*:*24.2 r2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s1:*:*:*:*:*:*24.2 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s2:*:*:*:*:*:*24.2 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s3:*:*:*:*:*:*24.2 r2-s3VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s4:*:*:*:*:*:*24.2 r2-s4VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s5:*:*:*:*:*:*24.2 r2-s5VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.4:-:*:*:*:*:*:*24.4VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.4:r1:*:*:*:*:*:*24.4 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.4:r1-s2:*:*:*:*:*:*24.4 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.4:r1-s3:*:*:*:*:*:*24.4 r1-s3VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.4:r2:*:*:*:*:*:*24.4 r2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s1:*:*:*:*:*:*24.4 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s2:*:*:*:*:*:*24.4 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s3:*:*:*:*:*:*24.4 r2-s3VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s4:*:*:*:*:*:*24.4 r2-s4VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.2:-:*:*:*:*:*:*25.2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.2:r1:*:*:*:*:*:*25.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s1:*:*:*:*:*:*25.2 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s2:*:*:*:*:*:*25.2 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.2:r2:*:*:*:*:*:*25.2 r2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.2:r2-s1:*:*:*:*:*:*25.2 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d10:*:*:*:*:*:*25.2x100 d10VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d20:*:*:*:*:*:*25.2x100 d20VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d21:*:*:*:*:*:*25.2x100 d21VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d22:*:*:*:*:*:*25.2x100 d22VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d30:*:*:*:*:*:*25.2x100 d30VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.4:-:*:*:*:*:*:*25.4VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.4:r1:*:*:*:*:*:*25.4 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.4:r1-s1:*:*:*:*:*:*25.4 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.4:r1-s2:*:*:*:*:*:*25.4 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.4x300:d10:*:*:*:*:*:*25.4x300 d10VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:25.4x300:d30:*:*:*:*:*:*25.4x300 d30VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:26.2:-:*:*:*:*:*:*26.2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:26.2:r1:*:*:*:*:*:*26.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*up to 23.1VulnerableJuniper
cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*23.2VulnerableJuniper
cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*23.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*23.2 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*23.2 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:*23.2 r2VulnerableJuniper
cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:*23.2 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:*23.2 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:23.2:r2-s3:*:*:*:*:*:*23.2 r2-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:23.2:r2-s4:*:*:*:*:*:*23.2 r2-s4VulnerableJuniper
cpe:2.3:o:juniper:junos:23.2:r2-s5:*:*:*:*:*:*23.2 r2-s5VulnerableJuniper
cpe:2.3:o:juniper:junos:23.2:r2-s6:*:*:*:*:*:*23.2 r2-s6VulnerableJuniper
cpe:2.3:o:juniper:junos:23.2:r2-s7:*:*:*:*:*:*23.2 r2-s7VulnerableJuniper
cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*23.4VulnerableJuniper
cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*23.4 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*23.4 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*23.4 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:*23.4 r2VulnerableJuniper
cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:*23.4 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:23.4:r2-s2:*:*:*:*:*:*23.4 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:23.4:r2-s3:*:*:*:*:*:*23.4 r2-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:23.4:r2-s4:*:*:*:*:*:*23.4 r2-s4VulnerableJuniper
cpe:2.3:o:juniper:junos:23.4:r2-s5:*:*:*:*:*:*23.4 r2-s5VulnerableJuniper
cpe:2.3:o:juniper:junos:23.4:r2-s6:*:*:*:*:*:*23.4 r2-s6VulnerableJuniper
cpe:2.3:o:juniper:junos:23.4:r2-s7:*:*:*:*:*:*23.4 r2-s7VulnerableJuniper
cpe:2.3:o:juniper:junos:23.4:r2-s8:*:*:*:*:*:*23.4 r2-s8VulnerableJuniper
cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:*24.2VulnerableJuniper
cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:*24.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:*24.2 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:24.2:r1-s2:*:*:*:*:*:*24.2 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:24.2:r2:*:*:*:*:*:*24.2 r2VulnerableJuniper
cpe:2.3:o:juniper:junos:24.2:r2-s1:*:*:*:*:*:*24.2 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:24.2:r2-s2:*:*:*:*:*:*24.2 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:24.2:r2-s3:*:*:*:*:*:*24.2 r2-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:24.2:r2-s4:*:*:*:*:*:*24.2 r2-s4VulnerableJuniper
cpe:2.3:o:juniper:junos:24.2:r2-s5:*:*:*:*:*:*24.2 r2-s5VulnerableJuniper
cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*24.4VulnerableJuniper
cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*24.4 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:*24.4 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:*24.4 r1-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:24.4:r2:*:*:*:*:*:*24.4 r2VulnerableJuniper
cpe:2.3:o:juniper:junos:24.4:r2-s1:*:*:*:*:*:*24.4 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:24.4:r2-s2:*:*:*:*:*:*24.4 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:24.4:r2-s3:*:*:*:*:*:*24.4 r2-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:24.4:r2-s4:*:*:*:*:*:*24.4 r2-s4VulnerableJuniper
cpe:2.3:o:juniper:junos:25.2:-:*:*:*:*:*:*25.2VulnerableJuniper
cpe:2.3:o:juniper:junos:25.2:r1:*:*:*:*:*:*25.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:25.2:r1-s1:*:*:*:*:*:*25.2 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:25.2:r1-s2:*:*:*:*:*:*25.2 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:25.2:r2:*:*:*:*:*:*25.2 r2VulnerableJuniper
cpe:2.3:o:juniper:junos:25.2:r2-s1:*:*:*:*:*:*25.2 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:25.4:-:*:*:*:*:*:*25.4VulnerableJuniper
cpe:2.3:o:juniper:junos:25.4:r1:*:*:*:*:*:*25.4 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:25.4:r1-s1:*:*:*:*:*:*25.4 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:25.4:r1-s2:*:*:*:*:*:*25.4 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:26.2:-:*:*:*:*:*:*26.2VulnerableJuniper
cpe:2.3:o:juniper:junos:26.2:r1:*:*:*:*:*:*26.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:26.2:r1-s1:*:*:*:*:*:*26.2 r1-s1VulnerableJuniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s5:*:*:*:*:*:* Versions 23.2 r2-s5 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s6:*:*:*:*:*:* Versions 23.2 r2-s6 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s7:*:*:*:*:*:* Versions 23.2 r2-s7 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.4:-:*:*:*:*:*:* Versions 23.4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.4:r1:*:*:*:*:*:* Versions 23.4 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s1:*:*:*:*:*:* Versions 23.4 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s2:*:*:*:*:*:* Versions 23.4 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.4:r2:*:*:*:*:*:* Versions 23.4 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s1:*:*:*:*:*:* Versions 23.4 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s2:*:*:*:*:*:* Versions 23.4 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s3:*:*:*:*:*:* Versions 23.4 r2-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s4:*:*:*:*:*:* Versions 23.4 r2-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s5:*:*:*:*:*:* Versions 23.4 r2-s5 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s6:*:*:*:*:*:* Versions 23.4 r2-s6 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s7:*:*:*:*:*:* Versions 23.4 r2-s7 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s8:*:*:*:*:*:* Versions 23.4 r2-s8 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:23.4x100:-:*:*:*:*:*:* Versions 23.4x100 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.2:-:*:*:*:*:*:* Versions 24.2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.2:r1:*:*:*:*:*:* Versions 24.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.2:r1-s2:*:*:*:*:*:* Versions 24.2 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.2:r2:*:*:*:*:*:* Versions 24.2 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s1:*:*:*:*:*:* Versions 24.2 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s2:*:*:*:*:*:* Versions 24.2 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s3:*:*:*:*:*:* Versions 24.2 r2-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s4:*:*:*:*:*:* Versions 24.2 r2-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s5:*:*:*:*:*:* Versions 24.2 r2-s5 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.4:-:*:*:*:*:*:* Versions 24.4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.4:r1:*:*:*:*:*:* Versions 24.4 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.4:r1-s2:*:*:*:*:*:* Versions 24.4 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.4:r1-s3:*:*:*:*:*:* Versions 24.4 r1-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.4:r2:*:*:*:*:*:* Versions 24.4 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s1:*:*:*:*:*:* Versions 24.4 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s2:*:*:*:*:*:* Versions 24.4 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s3:*:*:*:*:*:* Versions 24.4 r2-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s4:*:*:*:*:*:* Versions 24.4 r2-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.2:-:*:*:*:*:*:* Versions 25.2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.2:r1:*:*:*:*:*:* Versions 25.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s1:*:*:*:*:*:* Versions 25.2 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s2:*:*:*:*:*:* Versions 25.2 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.2:r2:*:*:*:*:*:* Versions 25.2 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.2:r2-s1:*:*:*:*:*:* Versions 25.2 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d10:*:*:*:*:*:* Versions 25.2x100 d10 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d20:*:*:*:*:*:* Versions 25.2x100 d20 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d21:*:*:*:*:*:* Versions 25.2x100 d21 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d22:*:*:*:*:*:* Versions 25.2x100 d22 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d30:*:*:*:*:*:* Versions 25.2x100 d30 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.4:-:*:*:*:*:*:* Versions 25.4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.4:r1:*:*:*:*:*:* Versions 25.4 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.4:r1-s1:*:*:*:*:*:* Versions 25.4 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.4:r1-s2:*:*:*:*:*:* Versions 25.4 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.4x300:d10:*:*:*:*:*:* Versions 25.4x300 d10 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:25.4x300:d30:*:*:*:*:*:* Versions 25.4x300 d30 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:26.2:-:*:*:*:*:*:* Versions 26.2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:26.2:r1:*:*:*:*:*:* Versions 26.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* Versions up to 23.1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:* Versions 23.2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:* Versions 23.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:* Versions 23.2 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:* Versions 23.2 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:* Versions 23.2 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:* Versions 23.2 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:* Versions 23.2 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.2:r2-s3:*:*:*:*:*:* Versions 23.2 r2-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.2:r2-s4:*:*:*:*:*:* Versions 23.2 r2-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.2:r2-s5:*:*:*:*:*:* Versions 23.2 r2-s5 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.2:r2-s6:*:*:*:*:*:* Versions 23.2 r2-s6 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.2:r2-s7:*:*:*:*:*:* Versions 23.2 r2-s7 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:* Versions 23.4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:* Versions 23.4 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:* Versions 23.4 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:* Versions 23.4 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:* Versions 23.4 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:* Versions 23.4 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.4:r2-s2:*:*:*:*:*:* Versions 23.4 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.4:r2-s3:*:*:*:*:*:* Versions 23.4 r2-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.4:r2-s4:*:*:*:*:*:* Versions 23.4 r2-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.4:r2-s5:*:*:*:*:*:* Versions 23.4 r2-s5 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.4:r2-s6:*:*:*:*:*:* Versions 23.4 r2-s6 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.4:r2-s7:*:*:*:*:*:* Versions 23.4 r2-s7 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:23.4:r2-s8:*:*:*:*:*:* Versions 23.4 r2-s8 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:* Versions 24.2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:* Versions 24.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:* Versions 24.2 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.2:r1-s2:*:*:*:*:*:* Versions 24.2 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.2:r2:*:*:*:*:*:* Versions 24.2 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.2:r2-s1:*:*:*:*:*:* Versions 24.2 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.2:r2-s2:*:*:*:*:*:* Versions 24.2 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.2:r2-s3:*:*:*:*:*:* Versions 24.2 r2-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.2:r2-s4:*:*:*:*:*:* Versions 24.2 r2-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.2:r2-s5:*:*:*:*:*:* Versions 24.2 r2-s5 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:* Versions 24.4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:* Versions 24.4 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:* Versions 24.4 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:* Versions 24.4 r1-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.4:r2:*:*:*:*:*:* Versions 24.4 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.4:r2-s1:*:*:*:*:*:* Versions 24.4 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.4:r2-s2:*:*:*:*:*:* Versions 24.4 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.4:r2-s3:*:*:*:*:*:* Versions 24.4 r2-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.4:r2-s4:*:*:*:*:*:* Versions 24.4 r2-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:25.2:-:*:*:*:*:*:* Versions 25.2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:25.2:r1:*:*:*:*:*:* Versions 25.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:25.2:r1-s1:*:*:*:*:*:* Versions 25.2 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:25.2:r1-s2:*:*:*:*:*:* Versions 25.2 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:25.2:r2:*:*:*:*:*:* Versions 25.2 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:25.2:r2-s1:*:*:*:*:*:* Versions 25.2 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:25.4:-:*:*:*:*:*:* Versions 25.4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:25.4:r1:*:*:*:*:*:* Versions 25.4 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:25.4:r1-s1:*:*:*:*:*:* Versions 25.4 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:25.4:r1-s2:*:*:*:*:*:* Versions 25.4 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:26.2:-:*:*:*:*:*:* Versions 26.2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:26.2:r1:*:*:*:*:*:* Versions 26.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:26.2:r1-s1:*:*:*:*:*:* Versions 26.2 r1-s1 Vulnerable ·Juniper

Remediation

Upgrade Junos OS to 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3 or 26.2R1-S2. Upgrade Junos OS Evolved to 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 26.2R1-S2-EVO, 25.2X100-D35-EVO or 25.4X300-D40-EVO.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Junos OS (Juniper Networks) Fixed in 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2
  • Fix · CNA Junos OS Evolved (Juniper Networks) Fixed in 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 26.2R1-S2-EVO, 25.2X100-D35-EVO, 25.4X300-D40-EVO

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Juniper Networks Junos OS, Junos OS Evolved — supportportal.juniper.net/JSA112187

    106 records Highest priority Priority MEDIUM 53 MEDIUM, 53 LOW

    Other records, highest priority first

    • TI-2026-74351 Stack overflow in Juniper Junos OS J-Web allows code executionPriority MEDIUM 49
    • TI-2026-74350 Stack-based buffer overflow in Junos OS rpd enables code executionPriority MEDIUM 49
    • TI-2026-74339 Improper authentication in Junos OS J-Web allows device takeoverPriority MEDIUM 49
    Show all 106 records → Advisory →

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-101990
  2. 2026-10-16 CISA SSVC decision points changed

References

Advisory 1

  • TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7
  • TI-2023-18644 Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files KEVCVSS 3.1MEDIUM 5.3
  • TI-2023-18640 Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files KEVCVSS 3.1MEDIUM 5.3
See all 792 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences