CVE-2026-101940: CWE-476 NULL Pointer Dereference in Juniper Networks Junos OS

This vulnerability (CVE-2026-101940) involves a NULL Pointer Dereference in the rpd routing daemon component of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated BGP peer that is configured can send a crafted BGP UPDATE message to trigger the flaw, causing a denial of service condition. The issue occurs only when ISO-VPN and egress-protection configuration is enabled. The vulnerability affects multiple versions across Junos OS and Junos OS Evolved, as specified by the affected version ranges. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (denial of service).

Successful exploitation results in a denial of service condition on the affected device, impacting availability. There is no confidentiality or integrity impact. The attack can be performed remotely by an unauthenticated configured BGP peer, making it a significant risk in environments where such peers exist and the vulnerable configurations are enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official remediation details are provided, users should monitor Juniper Networks advisories for updates. Until a fix is available, consider disabling ISO-VPN and egress-protection configurations if feasible, or restrict BGP peer configurations to trusted entities only to reduce exposure.