CVE-2026-102069 is a high-severity stack-based buffer overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices configured as Junos Fusion Aggregation Devices. It can be triggered by an adjacent attacker acting as the configured ICCP peer when dot1x synchronization is enabled for the required Fusion satellite topology. Successful exploitation may cause denial of service and potentially allow execution of code with root privileges.
CVE-2026-102070 is a reachable assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS. This flaw allows an unauthenticated network attacker to disrupt the rmopd service by sending a specific TCP packet. The vulnerability affects multiple versions of Junos OS prior to certain fixed releases. It has a high severity rating with a CVSS score of 7.5, indicating a significant impact on service availability without confidentiality or integrity compromise.
CVE-2026-101973 is a high-severity NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS. It allows an unauthenticated remote attacker to cause a denial of service by sending a malformed packet during CMP enrollment or automatic certificate re-enrollment. The vulnerability affects multiple versions of Junos OS prior to specific patch releases. No known exploits are reported in the wild at this time.
CVE-2026-102072 is a medium severity vulnerability in Juniper Networks Junos OS involving improper handling of highly compressed data in the gRPC library used by na-grpcd. An authenticated network-based attacker can exploit this flaw by sending a specially crafted compressed gRPC request to cause a denial of service (DoS). This vulnerability does not impact confidentiality or integrity but affects availability. Multiple versions of Junos OS prior to specific patch releases are affected. No known exploits are reported in the wild. No explicit patch links are provided in the input data.
CVE-2026-103994 is a heap-based buffer overflow vulnerability in the VXLAN Gateway Daemon (vgd) component of Juniper Networks Junos OS. It allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and potentially achieve remote code execution. The vulnerability has a high severity with a CVSS score of 8.8. Multiple versions of Junos OS prior to specific patch releases are affected.
CVE-2026-102063 is a reachable assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS on MX Series routers. It allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF. The vulnerability affects multiple versions of Junos OS prior to specific fixed releases. The CVSS score is 6.5, indicating a medium severity impact focused on availability disruption.
CVE-2026-101965 is a high-severity vulnerability in Juniper Networks Junos OS Evolved affecting the gRPC daemon. It involves an externally-controlled format string flaw in the gNMI service that can be exploited by an authenticated network attacker. Successful exploitation may lead to telemetry service disruption, information disclosure, or potentially root-level code execution.
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.
CVE-2026-102068 is a high-severity stack-based buffer overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved. It allows an unauthenticated remote attacker to cause a kernel panic by sending a specially crafted TCP packet when key-chain authentication is enabled for BGP or LDP. This vulnerability affects multiple versions of Junos OS Evolved prior to specific patch releases. No known exploits are reported in the wild at this time.
CVE-2026-101960 is an out-of-bounds write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved. It affects specific QFX series devices configured for BGP global-load-balancing with more than 128 ECMP next-hops. Exploitation can cause the rpd process to crash, resulting in denial of service. The vulnerability has a CVSS score of 6.5, indicating medium severity. No known exploits are reported in the wild. Affected versions span multiple releases prior to certain fixed builds as specified by Juniper.
CVE-2026-101978 is an OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series devices. It allows an unauthenticated attacker on the management LAN to execute arbitrary commands as root via a crafted gRPC response. The vulnerability affects multiple specific versions of Junos OS Evolved. The CVSS score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-101985 is a medium severity vulnerability in Juniper Networks Junos OS Evolved on PTX Series devices. It involves improper validation of specified quantity in input within the routing protocol daemon (rpd). An unauthenticated IS-IS peer can exploit this flaw to cause a denial of service (DoS) condition. The vulnerability does not impact confidentiality or integrity but affects availability. Multiple specific versions of Junos OS Evolved are affected. No explicit patch or remediation details are provided in the available data.
CVE-2026-101966 is a Use of Externally-Controlled Format String vulnerability in the jti-dialoutd component of Juniper Networks Junos OS Evolved. It allows an authenticated network attacker to cause a persistent denial of service affecting telemetry dial-out by submitting a crafted analytics sensor resource through the gNMI listener. The vulnerability has a high severity with a CVSS score of 8.2. Multiple versions of Junos OS Evolved are affected, including specific ranges in 23.x, 25.x, and 26.x releases.
A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable.
If an MX Series device is configured with web filtering, and an attacker sends a request with a specifically formatted URL, this request will get forwarded despite the system being configured to block it. In turn, an attacker can access downstream resources that are expected to be unreachable.
This issue affects Junos OS on MX Series:
* all versions before 23.2R2-S7,
* 23.4 versions before 23.4R2-S8,
* 24.2 versions before 24.2R2-S5,
* 24.4 versions before 24.4R2-S4,
* 25.2 versions before 25.2R2-S1,
* 25.4 versions before 25.4R1-S2, 25.4R2.
An Improper Handling of Undefined Parameters vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on EX Series devices allows an authenticated attacker with low privileges to cause a Denial-of-Service (DoS).
If an attempt is made to subscribe to an unsupported telemetry sensor path on EX2300, EX3400, EX4000, EX4100 and EX4400 via gRPC, this causes the FPC to crash. This leads to a complete service outage until the module has automatically restarted.
The following log message can be seen when this issue happens:
agentd[<PID>]: AGENTD_RESOURCE_NOT_FOUND: No resource name found for <sensor>
This issue affects Junos OS on
EX2300, EX3400, EX4000, EX4100 and EX4400
devices:
* all versions before 23.2R2-S7,
* 23.4 versions before 23.4R2-S8,
* 24.2 versions before 24.2R2-S5,
* 24.4 versions before 24.4R2.
An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows adjacent subscribers to bypass configured firewall filters.
On MX Series devices with MPC10/11, LC4800/9600, and MX304 with subscribers configured on static interfaces, ingress firewall filters are not enforced, so that neither protocol level nor upstream bandwidth limitation are in effect.
This issue affects Junos OS on MX with MPC10/11, LC4800/9600/4802, and MX304:
* 23.2 versions from 23.2R2-S1 before 23.2R2-S7,
* 23.4 versions from 23.4R2 before 23.4R2-S7,
* 24.2 versions before 24.2R2-S3,
* 24.4 versions before 24.4R2-S2,
* 25.2 versions before 25.2R2.
A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
As part of the stateful traffic processing on SRX Series devices flows are being established, and removed when not needed anymore. During the removal process the timeout of a flow should be set to 3 seconds and consequentially the flow should be removed shortly after. Due to a race condition occurring when setting the timeout there is a chance (the exact conditions are outside the attackers control) that the timeout is instead set to a very high value of larger than 10,000 seconds:
user@host> show security flow session | match timeout
Session ID: 98784248524, Policy name: PROD-FLOW/4, HA State: Active, Timeout: 85250, Session State: Valid
This will lead to an accumulation of flows which can be observed by an ever-increasing value of invalidated sessions in the output of 'show security flow session summary':
user@host> show security flow session summary | match invalid
Invalidated sessions: 216931These sessions can't be cleared manually with the 'clear security flow session' command, which will either lead to forwarding to stop (and the system needs to be manually recovered with a reboot) or to a flowd core and automatic reboot.
This issue affects Junos OS on SRX Series:
* 24.2 versions before 24.2R2-S3,
* 24.4 versions before 24.4R2-S1, 24.4R2-S2,
* 25.2 versions before 25.2R1-S2, 25.2R2.
This issue does not affect releases earlier than 24.2R1;
A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS).
When the reachability of an sFlow collector changes, the corresponding next-hop entry is updated. If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed.
This issue affects Junos OS Evolved on QFX Series:
* all 23.2 versions,
* 23.4 versions before 23.4R2-S7-EVO,
* 24.2 versions before 24.2R2-S5-EVO,
* 24.4 versions before 24.4R2-S3-EVO,
* 25.2 versions before 25.2R2-EVO.
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause license exhaustion.
Due to an incorrect initialization, a process which should only be able to communicate internally within the device, can be reached over the network via an open port. This leads to unauthorized access to the license management.
This issue affects all Junos OS Evolved versions before 23.2R2-EVO.
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series devices allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS).When sFlow is configured in a Virtual Chassis (VC) scenario with EX4100 Series or EX4400 Series devices, multicast traffic which is received on one VC member and sent out on another member leads to a memory leak and ultimately an FPC crash and restart.
The leak can be monitored by watching the continuous increase of the buffer values in the output of:
user@host> show chassis fpc
This issue affects Junos OS on EX4100 Series and EX4400:
* all versions before 23.2R2-S7,
* 23.4 versions before 23.4R2-S7,
* 24.2 versions before 24.2R2-S4,
* 24.4 versions before 24.4R2.