Threat Intelligence Database

CVE-2026-57025 is a vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting EX, QFX, and MX Series devices. It involves a return of pointer value outside the expected range in the fileio library, allowing a local low-privileged attacker to cause a Denial-of-Service (DoS). Specifically, issuing a crafted 'show l2-learning' command causes the l2ald process to crash, temporarily impacting all layer 2 services until automatic restart. The vulnerability affects multiple versions prior to specific patched releases.

CVE-2026-57019 is a vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series devices. It involves improper validation of specified quantity in input, causing incorrect packet size calculation when receiving certain packets from devices in the same broadcast domain. This leads to packet processing failure, triggering a major FPC error and an FPC reset that disrupts traffic until recovery. The issue affects scenarios such as MAP-T or non-IP traffic encapsulated in IP (e.g., MPLS over GRE).

A missing authorization vulnerability in the CLI of Juniper Networks Junos OS on certain EX Series switches allows a local, authenticated attacker without specific permissions to execute a privileged command causing a denial-of-service (DoS). The affected devices include EX2300, EX4000, EX4100, EX4300-MP, and EX4400 switches. The issue impacts Junos OS versions 23.2R2, 23.4, 24.2, 24.4, 25.2, and 25.4 before their respective fixed releases. The system recovers automatically after the DoS condition. The vulnerability has a CVSS score of 5.5 (medium severity).

CVE-2026-33801 is a vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the routing protocol daemon (RPD). An adjacent, unauthenticated attacker can send a specially crafted BGP update that triggers an RPD crash and restart, causing a denial-of-service (DoS) until routing reconverges. This issue affects Junos OS and Junos OS Evolved version 25.2 before 25.2R2 and 25.2R2-EVO respectively. Versions before 25.2R1 are not affected. The vulnerability does not propagate downstream because the crash occurs before the update is readvertised.

CVE-2026-33800 is a medium severity vulnerability in Juniper Networks Junos OS on MX Series devices up to MPC9. It involves unchecked input for a loop condition in the Packet Forwarding Engine, allowing an unauthenticated adjacent attacker to cause a denial-of-service by triggering continuous Micro-BFD session flaps. This leads to event processing delays, watchdog timer expiration, and FPC crashes causing service outages. The issue does not affect MPC10/11, LC4800/9600, or MX304 devices. Fixed versions are available starting from 23.2R2-S7, 23.4R2-S8, 24.2R2-S4, 24.4R2-S3, and 25.2R2.