Juniper Networks: 25 Junos OS Vulnerabilities Disclosed, Including Critical RCE Flaws
Key findings • Juniper Networks disclosed 25 vulnerabilities in Junos OS and Junos OS Evolved on October 14, 2026. • Multiple critical vulnerabilities (CVSSv3 9.8) allow for remote code execu…
Key findings
- Juniper Networks disclosed 25 vulnerabilities in Junos OS and Junos OS Evolved on October 14, 2026.
- Multiple critical vulnerabilities (CVSSv3 9.8) allow for remote code execution and device takeover.
- Key affected components include the routing protocol daemon (rpd), J-Web, and the Packet Forwarding Engine (PFE).
- Vulnerabilities span various protocols including BGP, EVPN, LDP, and OSPF.
- Users must consult Juniper advisories for specific affected versions and remediation steps.
On October 14, 2026, Juniper Networks disclosed a significant batch of 25 vulnerabilities affecting its Junos OS and Junos OS Evolved network operating systems. The vulnerabilities, disclosed within a single hour, span a range of severities, including multiple critical and high-risk flaws, primarily impacting the routing protocol daemon (rpd) and the Packet Forwarding Engine (PFE). These issues could lead to denial-of-service conditions, arbitrary code execution, and complete device takeover.
A significant number of these vulnerabilities are stack-based buffer overflows, affecting critical network functions. CVE-2026-101983, CVE-2026-101982, CVE-2026-101954, CVE-2026-33796, CVE-2026-33792, and CVE-2026-33789 are particularly concerning, with critical or high severity ratings and the potential for remote code execution or root-level access. These flaws are found in components such as the httpd process, the routing protocol daemon (rpd), and the srxpfe on SRX Series devices.
Several vulnerabilities target the routing protocol daemon (rpd) and its handling of various routing protocols and features. These include issues related to BGP, EVPN, LDP, OSPF, and SRv6. For instance, CVE-2026-101981 and CVE-2026-101976 detail stack-based buffer overflows and out-of-bounds writes in the rpd, exploitable by adjacent or configured peers. CVE-2026-101963 and CVE-2026-101961 highlight rpd crashes due to incorrect calculations and improper handling of length parameters in BGP EVPN updates. Additionally, CVE-2026-101952 describes an issue with improper validation of consistency within input for BGP ISO-VPN peers, leading to rpd crashes.
The J-Web management interface is also implicated, with CVE-2026-101954 being a critical vulnerability allowing unauthenticated network attackers to gain root-level device configuration access and take over the device. Another critical vulnerability, CVE-2026-101983, affects the httpd process within J-Web, enabling remote code execution and denial of service.
Other notable vulnerabilities include CVE-2026-102077, a high-severity Improper Check for Unusual or Exceptional Conditions in the Packet Forwarding Engine (PFE) on MX Series devices with SPC3, which can lead to a denial-of-service. CVE-2026-101979, a high-severity stack-based buffer overflow in the authd process, allows network attackers with SNMP read access to execute code with root privileges or cause a denial of service. Furthermore, CVE-2026-103994, a heap-based buffer overflow in the VXLAN Gateway Daemon (vgd), could lead to a complete outage of the OVSDB control plane and potential remote code execution.
Juniper Networks has released security advisories detailing the affected versions and providing information on patches and workarounds. Users are strongly advised to consult the official Juniper advisories for specific version information and remediation steps. The sheer volume and severity of this batch underscore the importance of timely patching and vigilant network security monitoring for Juniper devices.
The widespread impact across various Junos OS components, from core routing functions to management interfaces, necessitates a comprehensive review of security configurations and an expedited patching process for all affected systems.
The following CVEs were part of this disclosure: CVE-2026-102077, CVE-2026-101983, CVE-2026-101982, CVE-2026-101981, CVE-2026-101979, CVE-2026-101976, CVE-2026-101975, CVE-2026-101972, CVE-2026-101964, CVE-2026-101963, CVE-2026-101962, CVE-2026-101961, CVE-2026-101959, CVE-2026-101954, CVE-2026-101952, CVE-2026-101949, CVE-2026-33798, CVE-2026-33796, CVE-2026-33795, CVE-2026-33792, CVE-2026-33789, CVE-2026-103994, CVE-2026-103993, CVE-2026-102185, CVE-2026-102184.