Juniper Junos OS Evolved: 25 Vulnerabilities Disclosed, Including Critical RCE Flaws
Key findings • 25 vulnerabilities disclosed in Juniper Networks Junos OS and Junos OS Evolved on October 14, 2026. • Multiple critical vulnerabilities (CVSSv3 9.8) allow for remote code execu…
Key findings
- 25 vulnerabilities disclosed in Juniper Networks Junos OS and Junos OS Evolved on October 14, 2026.
- Multiple critical vulnerabilities (CVSSv3 9.8) allow for remote code execution and device takeover.
- Key affected components include the routing protocol daemon (rpd), J-Web, and the SRX Series Packet Forwarding Engine (PFE).
- Vulnerabilities span various protocols including BGP, EVPN, LDP, and OSPF.
- Users must consult Juniper advisories for specific affected versions and remediation steps.
On October 14, 2026, Juniper Networks disclosed a significant batch of 25 vulnerabilities affecting its Junos OS and Junos OS Evolved network operating systems. The vulnerabilities, disclosed within a single hour, span a range of severities, including multiple critical flaws with a CVSSv3 score of 9.8, potentially allowing for remote code execution and device takeover. The disclosures highlight weaknesses across several key components, including the routing protocol daemon (rpd), the J-Web management interface, and the SRX Series Packet Forwarding Engine (PFE).
A substantial number of these vulnerabilities stem from stack-based buffer overflows and improper handling of various protocol messages. The routing protocol daemon (rpd) is particularly affected, with numerous CVEs detailing flaws related to BGP, EVPN, LDP, and OSPF processing. For instance, CVE-2026-101982 and CVE-2026-33796 describe stack-based buffer overflows in rpd that could lead to root code execution or command execution via crafted BGP or EVPN route advertisements, especially when BGP Monitoring Protocol (BMP) is enabled. Similarly, CVE-2026-101981 details an rpd stack-based buffer overflow triggered by malformed LDP Label Mapping messages.
The J-Web management interface is also a target, with CVE-2026-101983 and CVE-2026-101954 presenting critical vulnerabilities. CVE-2026-101983 is a stack-based buffer overflow in the httpd process allowing remote code execution and denial of service, while CVE-2026-101954 is an improper authentication vulnerability that could lead to root-level device configuration access and device takeover. Another critical vulnerability, CVE-2026-102178, is a stack-based buffer overflow in the BGP routing daemon affecting flowspec route re-advertisement when update-threading is enabled.
Several vulnerabilities focus on denial-of-service (DoS) conditions. CVE-2026-101976, an out-of-bounds write in rpd, can be triggered by a malformed BGP update. CVE-2026-101962 and CVE-2026-101961 describe rpd crashes due to improper handling of BGP EVPN multicast updates and NULL pointer dereferences in routing-policy matchers, respectively. Other DoS vulnerabilities include reachable assertions in rpd (CVE-2026-101975, CVE-2026-101964), integer overflows (CVE-2026-101972), and infinite loops (CVE-2026-102185).
The disclosures also include vulnerabilities affecting specific Juniper hardware, such as CVE-2026-33798, a stack-based buffer overflow in the SRX Series srxpfe component that allows arbitrary code execution via high-availability fabric traffic.
Juniper Networks has provided advisories detailing the specific affected versions and remediation steps for each vulnerability. Users are strongly advised to consult these advisories and apply the necessary patches and updates to mitigate the risks associated with these critical flaws. The coordinated disclosure of these 25 vulnerabilities underscores the importance of timely patching and security vigilance for network infrastructure.
The breadth of affected components and protocols, coupled with the presence of critical remote code execution flaws, makes this a significant disclosure for Juniper Networks customers. Prompt attention to the vendor's security advisories and the implementation of recommended mitigations are crucial for maintaining the security and integrity of network devices running Junos OS and Junos OS Evolved.
Key affected components include the routing protocol daemon (rpd), J-Web, and the SRX Series Packet Forwarding Engine (PFE). Vulnerabilities span various protocols including BGP, EVPN, LDP, and OSPF. Users must consult Juniper advisories for specific affected versions and remediation steps.
This batch of 25 vulnerabilities, disclosed on October 14, 2026, highlights critical security weaknesses in Juniper Networks' Junos OS and Junos OS Evolved. The vulnerabilities range from denial-of-service to remote code execution, impacting core network functions.
The disclosures include multiple critical vulnerabilities (CVSSv3 9.8) that allow for remote code execution and device takeover. For example, CVE-2026-101983 and CVE-2026-101954 are critical flaws in the J-Web interface, while CVE-2026-101982 and CVE-2026-33796 are critical flaws in the routing protocol daemon (rpd).
The vulnerabilities span various protocols including BGP, EVPN, LDP, and OSPF. Many of these flaws are stack-based buffer overflows or improper handling of protocol messages, leading to crashes or code execution.
Users are urged to consult Juniper advisories for specific affected versions and remediation steps. The coordinated disclosure of these 25 vulnerabilities emphasizes the need for prompt patching and security updates.