CVE-2026-101992: CWE-20 Improper Input Validation in Juniper Networks Junos OS

This vulnerability (CVE-2026-101992) involves improper input validation (CWE-20) in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. Specifically, a maliciously crafted BGP VPLS signaling update from a configured BGP peer can cause the rpd process to crash, resulting in denial of service. The vulnerability affects a range of versions across multiple Junos OS releases and their evolved variants. The CVSS 3.1 vector indicates the attack requires adjacent network access with low complexity, no privileges, and no user interaction, impacting availability only.

Successful exploitation results in a denial of service condition by crashing the routing protocol daemon (rpd), which could disrupt routing functionality on affected devices. There is no impact on confidentiality or integrity according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no vendor advisory or patch links are provided, users should monitor Juniper Networks' official security advisories for updates and apply patches or mitigations as soon as they become available. Until then, consider limiting BGP peer access to trusted entities to reduce exposure.