An Execution with Unnecessary Privileges vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to gain root privileges, thus compromising the system.
When a configuration that allows unsigned Python op scripts is present on the device, a non-root user is able to execute malicious op scripts as a root-equivalent user, leading to privilege escalation.
This issue affects Junos OS:
* All versions before 22.4R3-S7,
* from 23.2 before 23.2R2-S4,
* from 23.4 before 23.4R2-S6,
* from 24.2 before 24.2R1-S2, 24.2R2,
* from 24.4 before 24.4R1-S2, 24.4R2;
Junos OS Evolved:
* All versions before 22.4R3-S7-EVO,
* from 23.2 before 23.2R2-S4-EVO,
* from 23.4 before 23.4R2-S6-EVO,
* from 24.2 before 24.2R2-EVO,
* from 24.4 before 24.4R1-S1-EVO, 24.4R2-EVO.
A Missing Authentication for Critical Function vulnerability in command processing of Juniper Networks Junos OS allows a privileged local attacker to gain access to Linux-based line cards as root.
This issue affects systems running Junos OS using Linux-based line cards. Affected line cards include:
* MPC7, MPC8, MPC9, MPC10, MPC11
* LC2101, LC2103
* LC480, LC4800, LC9600
* MX304 (built-in FPC)
* MX-SPC3
* SRX5K-SPC3
* EX9200-40XS
* FPC3-PTX-U2, FPC3-PTX-U3
* FPC3-SFF-PTX
* LC1101, LC1102, LC1104, LC1105
This issue affects Junos OS:
* all versions before 22.4R3-S8,
* from 23.2 before 23.2R2-S6,
* from 23.4 before 23.4R2-S6,
* from 24.2 before 24.2R2-S3,
* from 24.4 before 24.4R2,
* from 25.2 before 25.2R2.
An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root.
The On-Box Anomaly detection framework should only be reachable by other internal processes over the internal routing instance, but not over an externally exposed port. With the ability to access and manipulate the service to execute code as root a remote attacker can take complete control of the device.
Please note that this service is enabled by default as no specific configuration is required.
This issue affects Junos OS Evolved on PTX Series:
* 25.4 versions before 25.4R1-S1-EVO, 25.4R2-EVO.
This issue does not affect Junos OS Evolved versions before 25.4R1-EVO.
This issue does not affect Junos OS.
An Authentication Bypass Using an
Alternate Path or Channel vulnerability in Juniper Networks Session Smart
Router may allows a network-based attacker to bypass authentication
and take administrative control of the device.
This issue affects Session Smart Router:
* from 5.6.7 before 5.6.17,
* from 6.0 before 6.0.8 (affected from 6.0.8),
* from 6.1 before 6.1.12-lts,
* from 6.2 before 6.2.8-lts,
* from 6.3 before 6.3.3-r2;
This issue affects Session Smart Conductor:
* from 5.6.7 before 5.6.17,
* from 6.0 before 6.0.8 (affected from 6.0.8),
* from 6.1 before 6.1.12-lts,
* from 6.2 before 6.2.8-lts,
* from 6.3 before 6.3.3-r2;
This issue affects WAN Assurance Managed Routers:
* from 5.6.7 before 5.6.17,
* from 6.0 before 6.0.8 (affected from 6.0.8),
* from 6.1 before 6.1.12-lts,
* from 6.2 before 6.2.8-lts,
* from 6.3 before 6.3.3-r2.
CVE-2026-21921 is a Use After Free vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS and Junos OS Evolved. It allows a network-based attacker with low privileges to cause a denial-of-service (DoS) by triggering crashes in telemetry-capable processes through frequent subscription and unsubscription to sensors. Affected versions include all Junos OS and Junos OS Evolved releases prior to 22.4R3-S8, 23.2R2-S5, and 23.4R2. The vulnerability results in process crashes and restarts, potentially causing complete outages until recovery. The CVSS score is 6.5 (medium severity), reflecting no confidentiality or integrity impact but high availability impact. No known exploits are currently reported in the wild.
CVE-2026-21920 is a high-severity vulnerability in Juniper Networks Junos OS affecting SRX Series devices configured for DNS processing. An unauthenticated, network-based attacker can send a specially crafted DNS request that triggers a crash and restart of the flowd process, causing a denial-of-service (DoS) condition. This vulnerability affects Junos OS versions 23.4 prior to 23.4R2-S5, 24.2 prior to 24.2R2-S1, and 24.4 prior to 24.4R2. No user interaction or authentication is required to exploit this flaw.
CVE-2026-21918 is a high-severity double free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS running on SRX and MX Series devices. An unauthenticated attacker can trigger this flaw remotely by sending a specific sequence of TCP packets during session establishment, causing flowd to crash and the Flexible PIC Concentrator (FPC) to restart, resulting in a denial-of-service (DoS). This vulnerability affects multiple Junos OS versions prior to 22.4R3-S7, 23.2R2-S3, 23.4R2-S4, and 24.2R2. Exploitation requires no authentication or user interaction and impacts availability without compromising confidentiality or integrity. No known exploits are currently reported in the wild. European organizations using Juniper SRX or MX Series devices should prioritize patching to prevent potential service disruptions, especially in critical network infrastructure.
CVE-2026-21917 is a high-severity vulnerability in Juniper Networks Junos OS affecting SRX Series devices with UTM Web-Filtering enabled. An unauthenticated attacker can send a specially crafted malformed SSL packet to cause an FPC crash and restart, resulting in a denial-of-service (DoS) condition. The flaw arises from improper validation of syntactic correctness of input in the Web-Filtering module. Affected versions include multiple recent releases from 23.2 through 24.4, with no fixes available for earlier versions. Exploitation requires no authentication or user interaction and can be performed remotely over the network. Although no known exploits are currently reported in the wild, the vulnerability poses a significant risk to availability of critical network security infrastructure. European organizations relying on Juniper SRX devices for perimeter security and web filtering are particularly at risk. Mitigation involves upgrading to fixed Junos OS versions where available or applying compensating controls to limit exposure.
CVE-2026-21914 is a high-severity improper locking vulnerability in the GTP plugin of Juniper Networks Junos OS on SRX Series devices. An unauthenticated attacker can send a malformed GTP Modify Bearer Request message that causes a lock to be acquired and never released, leading to a watchdog timeout and FPC crash. This results in a denial-of-service condition causing complete traffic outage until the device recovers. The vulnerability affects multiple Junos OS versions prior to specific patched releases across versions 22.4R3-S8 through 25.2R2. Exploitation requires no authentication or user interaction and can be performed remotely over the network. There are no known exploits in the wild as of now. The CVSS v3.1 score is 7.
CVE-2026-21913 is a high-severity vulnerability in Juniper Networks Junos OS affecting EX4000-48T, EX4000-48P, and EX4000-48MP models. It involves incorrect initialization of resources in the Internal Device Manager (IDM), allowing unauthenticated, network-based attackers to trigger a denial-of-service (DoS) by sending a high volume of traffic. This causes the FXPC component to crash and restart, resulting in a complete service outage until reboot. The issue affects Junos OS versions 24.4 before 24.4R2 and 25.2 before 25.2R1-S2 and 25.2R2. No user interaction or authentication is required, and the attack surface is network-exposed.
CVE-2026-21912 is a medium severity TOCTOU race condition vulnerability in Juniper Networks Junos OS affecting MX10k Series with LC480 or LC2101 line cards. A local, low-privileged attacker can repeatedly execute the 'show system firmware' CLI command to cause the affected line cards to crash and restart, potentially leading to chassisd process crashes and core dumps. This vulnerability impacts multiple Junos OS versions prior to specific patch releases. Exploitation does not require user interaction but requires local access with low privileges. The vulnerability results in availability disruption without compromising confidentiality or integrity. No known exploits are currently in the wild. European organizations using MX10k Series routers with these line cards should prioritize patching to prevent potential denial-of-service conditions. Countries with significant Juniper infrastructure deployments and critical network backbones are at higher risk. Mitigation involves applying vendor patches once available and restricting local CLI access to trusted administrators only.
CVE-2026-21911 is an incorrect calculation vulnerability in the Layer 2 Control Protocol Daemon (l2cpd) of Juniper Networks Junos OS Evolved. It allows an unauthenticated network-adjacent attacker to flap the management interface, causing the system to stop learning new MAC addresses over label-switched interfaces and generating excessive logs that lead to high CPU usage. This results in a denial-of-service condition affecting network device availability. The vulnerability affects multiple versions of Junos OS Evolved prior to specific patched releases. Exploitation does not require authentication or user interaction but requires network adjacency. The CVSS score is 6.5 (medium severity) with impact primarily on availability. No known exploits are reported in the wild yet.
CVE-2026-21910 is a medium-severity vulnerability in Juniper Networks Junos OS affecting EX4k and QFX5k Series platforms that support EVPN-VXLAN VPLAG configurations. An unauthenticated network-adjacent attacker can cause a denial of service by flapping an interface, which leads to traffic drops between VXLAN Network Identifiers (VNIs). The issue arises when multiple load-balanced next-hop routes exist for the same destination and a link flap occurs in an EVPN-VXLAN LAG. Recovery requires manual restart of the affected FPC slot. The vulnerability affects multiple Junos OS versions prior to specific patched releases. No known exploits are currently reported in the wild. Defenders should prioritize patching affected devices and consider network design adjustments to mitigate impact.
CVE-2026-21909 is a medium-severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting versions 23.2, 23.4, and 24.1 before certain patches. It involves a missing release of memory after its effective lifetime in the routing protocol daemon (rpd), specifically triggered by an unauthenticated attacker controlling an adjacent IS-IS neighbor sending crafted update packets. This causes a memory leak that can exhaust system memory, leading to a crash of the rpd process and a denial of service (DoS). No confidentiality or integrity impact is reported, and exploitation does not require authentication or user interaction but does require adjacency in the IS-IS network. Monitoring memory usage via 'show task memory detail' can help detect exploitation attempts. No known exploits are currently in the wild. European organizations relying on Juniper routing infrastructure with IS-IS enabled are at risk, especially in countries with critical network infrastructure and high Juniper market penetration.
A Use After Free vulnerability was identified in the 802.1X authentication daemon (dot1xd) of Juniper Networks Junos OS and Junos OS Evolved that could allow an authenticated, network-adjacent attacker flapping a port to crash the dot1xd process, leading to a Denial of Service (DoS), or potentially execute arbitrary code within the context of the process running as root.
The issue is specific to the processing of a change in authorization (CoA) when a port bounce occurs. A pointer is freed but was then referenced later in the same code path. Successful exploitation is outside the attacker's direct control due to the specific timing of the two events required to execute the vulnerable code path.
This issue affects systems with 802.1X authentication port-based network access control (PNAC) enabled.
This issue affects:
Junos OS:
* from 23.2R2-S1 before 23.2R2-S5,
* from 23.4R2 before 23.4R2-S6,
* from 24.2 before 24.2R2-S3,
* from 24.4 before 24.4R2-S1,
* from 25.2 before 25.2R1-S2, 25.2R2;
Junos OS Evolved:
* from 23.2R2-S1 before 23.2R2-S5-EVO,
* from 23.4R2 before 23.4R2-S6-EVO,
* from 24.2 before 24.2R2-S3-EVO,
* from 24.4 before 24.4R2-S1-EVO,
* from 25.2 before 25.2R1-S2-EVO, 25.2R2-EVO.
CVE-2026-21907 is a medium severity vulnerability in Juniper Networks Junos Space affecting versions before 24.1R5. It involves the use of static key ciphers in the TLS/SSL server, which are considered broken or risky cryptographic algorithms. These static key ciphers reduce the confidentiality of data by allowing potential on-path attackers to decrypt traffic and do not support Perfect Forward Secrecy (PFS), compromising long-term confidentiality. The vulnerability does not affect integrity or availability and requires no authentication or user interaction but has a high attack complexity. No known exploits are currently reported in the wild. European organizations using Junos Space for network management should prioritize upgrading to versions 24.1R5 or later to mitigate this risk. Countries with significant Juniper Networks deployments, such as Germany, France, and the UK, are more likely to be impacted due to their extensive telecommunications and enterprise infrastructure. Mitigation involves disabling static key ciphers and enabling PFS-capable cipher suites, alongside applying vendor patches once available.
CVE-2026-21906 is a high-severity vulnerability in Juniper Networks Junos OS running on SRX Series devices. It involves improper handling of exceptional conditions in the packet forwarding engine (PFE) when processing a specific ICMP packet sent through a GRE tunnel with PowerMode IPsec (PMI) and GRE performance acceleration enabled. An unauthenticated attacker can exploit this remotely to cause the PFE to crash and restart, resulting in traffic loss and potential denial of service. PMI is enabled by default, and GRE performance acceleration is configurable on certain SRX platforms, increasing exposure. The vulnerability affects multiple Junos OS versions prior to specific patched releases. Although no exploits are currently known in the wild, the ease of network-based exploitation without authentication makes this a significant risk for organizations using affected SRX devices. Immediate patching and configuration review are recommended to mitigate impact.
CVE-2026-21905 is a high-severity vulnerability in Juniper Networks Junos OS affecting SRX Series and MX Series devices with MX-SPC3 or MS-MPC service cards. It involves an infinite loop triggered by malformed SIP messages over TCP, causing the flow management process to crash and resulting in a denial of service (DoS). The vulnerability requires no authentication or user interaction and affects multiple Junos OS versions prior to specific patched releases. SIP messages over UDP are not affected. Exploitation leads to a crash of critical processes (flowd or mspmand), disrupting network traffic handling. No known exploits are currently reported in the wild. European organizations relying on Juniper SRX or MX Series devices for network security and routing are at risk of service disruption. Mitigation requires timely patching to the fixed Junos OS versions. Network-level filtering of SIP TCP traffic and monitoring for anomalous SIP message patterns can reduce exposure. Countries with high adoption of Juniper infrastructure and critical telecom or enterprise networks are most likely impacted.
CVE-2026-21903 is a stack-based buffer overflow vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS. It allows a network-based attacker with low privileges and no user interaction to cause a denial-of-service (DoS) by crashing and restarting the Flexible PIC Concentrator (FPC) through subscribing to telemetry sensors at scale. The vulnerability affects multiple versions of Junos OS prior to 22.4R3-S7, 23.2 before 23.2R2-S4, and 23.4 before 23.4R2. The issue does not occur if YANG packages for the specific sensors are installed. The CVSS 3.
An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS allows an unauthenticated, network-adjacent attacker sending a specifically malformed ICMP packet to cause an FPC to crash and restart, resulting in a Denial of Service (DoS).
When an ICMP packet is received with a specifically malformed IP header value, the FPC receiving the packet crashes and restarts. Due to the specific type of malformed packet, adjacent upstream routers would not forward the packet, limiting the attack surface to adjacent networks.
This issue only affects ICMPv4. ICMPv6 is not vulnerable to this issue.
This issue does not affect AFT-based line cards such as the MPC10, MPC11, LC4800, LC9600, and MX304.
This issue affects Junos OS:
* all versions before 21.2R3-S9,
* from 21.4 before 21.4R3-S10,
* from 22.2 before 22.2R3-S7,
* from 22.3 before 22.3R3-S4,
* from 22.4 before 22.4R3-S5,
* from 23.2 before 23.2R2-S3,
* from 23.4 before 23.4R2-S3,
* from 24.2 before 24.2R1-S2, 24.2R2.
