CVEs published in October 2026

CVE-2026-33798High

Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic

CVE-2026-33796Critical

Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring

CVE-2026-33795High

Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised

CVE-2026-33792Critical

Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel

CVE-2026-33789Critical

Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled

CVE-2026-102185High

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election

CVE-2026-102184High

Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update

CVE-2026-102183High

Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP EVPN peer to cause an rpd crash via a specifically malformed NLRI

CVE-2026-102182Critical

Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets

CVE-2026-102180High

Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active

CVE-2026-102179High

Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed

CVE-2026-102178Critical

Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled

CVE-2026-102177High

Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured

CVE-2026-102176High

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled

CVE-2026-102175Critical

Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection

CVE-2026-102174High

Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS identity-publishing path

CVE-2026-102061High

Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message

CVE-2026-102060Medium

NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network

CVE-2026-102059High

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server

CVE-2026-102058Medium

Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic

CVE-2026-102057High

Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP client response

CVE-2026-102056High

Junos OS and Junos OS Evolved: An attacker causes denial of service and information disclosure when Ethernet CFM is enabled

CVE-2026-102055High

Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remote code execution and denial of service when enhanced CFM is enabled

CVE-2026-102054Medium

Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configured

CVE-2026-102053Medium

Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used

CVE-2026-102052High

Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-client feature is used

CVE-2026-102051Medium

Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion when LLDP fast receive processing is enabled

CVE-2026-102050High

Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of service when LLDP is enabled

CVE-2026-102049High

Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code execution when Unified Access Policy is enabled

CVE-2026-102048Medium

Junos OS: An attacker causes l2cpd crash when FNP is used with VLAN-VPLS encapsulation enabled

CVE-2026-102047Medium

Junos OS and Junos OS Evolved: An attacker causes l2cpd denial of service when MVRP is used

CVE-2026-102046High

Junos OS: MX Series: An attacker causes a Routing Engine denial of service when SCTP service is used

CVE-2026-102045Medium

Junos OS Evolved: An crafted LACP frame causes lacpd to crash when LACP is enabled

CVE-2026-102044High

Junos OS and Junos OS Evolved: An attacker causes a routing control-plane denial of service when BGP-LS traffic engineering is enabled

CVE-2026-102043Medium

Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when MPLS-TE fast reroute is enabled

CVE-2026-102042Medium

Junos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP associated-bidirectional LSP is enabled

CVE-2026-102041Medium

Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when RSVP is enabled

CVE-2026-102040Medium

Junos OS and Junos OS Evolved: An attacker crashes the routing daemon when co-routed bidirectional RSVP LSPs are used

CVE-2026-102039Medium

Junos OS and Junos OS Evolved: An attacker causes routing-process denial of service when GMPLS EVPL dynamic transport is used

CVE-2026-102037High

Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used

CVE-2026-102036High

Junos OS and Junos OS Evolved: An EVPN default-gateway route burst causes l2ald denial of service

CVE-2026-102035Medium

Junos OS and Junos OS Evolved: An attacker causes a denial of service when MC-LAG IRB MAC synchronization is enabled

CVE-2026-102034Medium

Junos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LAG ICCP MAC synchronization is enabled

CVE-2026-102033Medium

Junos OS and Junos OS Evolved: An attacker causes denial of service when MC-LAG MAC synchronization is enabled

CVE-2026-102032Medium

Junos OS and Junos OS Evolved: Unintended l2ald memory allocation causes a denial of service when static MAC IP configurations are present

CVE-2026-102031Critical

Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled

CVE-2026-102030High

Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used

CVE-2026-102029High

Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when an MSDP or PIM policy uses AS-path expansion

CVE-2026-102028High

Junos OS and Junos OS Evolved: An attacker causes an rpd crash when VPLS auto-discovery is used

CVE-2026-102027High

Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath next-hops are processed

CVE-2026-102026High

Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is used

CVE-2026-102025High

Junos OS and Junos OS Evolved: A BGP route-processing error causes rpd crash when extended next-hop tunneling and SRv6 service processing are used

CVE-2026-102024High

Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP extended-nexthop-tunnel is used

CVE-2026-102023High

Junos OS Evolved: An attacker causes denial of service via SNMP when firewall counters are used

CVE-2026-102022High

Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when BGP-LS traffic-engineering is enabled

CVE-2026-102021Medium

Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MPLS-TE error processing is enabled

CVE-2026-102020High

Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when BGP-LS TED export is enabled

CVE-2026-102019Medium

Junos OS and Junos OS Evolved: Malformed RIPv2 messages cause routing service disruption when RIP is enabled

CVE-2026-102018Medium

Junos OS and Junos OS Evolved: Malformed PIM Bidir DF-Election messages cause routing service disruption when bidirectional PIM is enabled

CVE-2026-102017Medium

Junos OS and Junos OS Evolved: An attacker causes routing-plane denial of service when Auto-RP mapping is enabled

CVE-2026-102016High

Junos OS and Junos OS Evolved: An attacker causes a routing outage when BGP MVPN signaling is enabled

CVE-2026-102015High

Junos OS and Junos OS Evolved: An attacker causes root code execution when 802.1X authentication is used

CVE-2026-102014High

Junos OS: An attacker causes authd to crash when subscriber RADIUS authentication is used

CVE-2026-102013Medium

Junos OS and Junos OS Evolved: An attacker causes na-grpcd to crash when the InitialSync service is used

CVE-2026-102012High

Junos OS Evolved: An attacker causes na-grpcd to crash when gRPC telemetry is enabled

CVE-2026-102011Medium

Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP link protection is enabled

CVE-2026-102000Medium

Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled

CVE-2026-101999Medium

Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled

CVE-2026-101971Medium

Junos OS and Junos OS Evolved: An attacker causes routing protocol daemon crash when OSPFv3 is enabled

CVE-2026-101970Medium

Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used

CVE-2026-101969Medium

Junos OS and Junos OS Evolved: An unauthenticated attacker causes rpd denial of service when IPv6 PIM is enabled

CVE-2026-101968Medium

Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd heap memory disclosure when Rosen-MVPN data-MDT is enabled

CVE-2026-101946Low

Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosure when IPv6 LDP is used

CVE-2026-101945High

Junos OS and Junos OS Evolved: An attacker causes routing daemon denial of service when EVPN BGP is enabled

CVE-2026-101944High

Junos OS and Junos OS Evolved: An attacker causes a routing protocol daemon denial of service when EVPN is used

CVE-2026-101943High

Junos OS and Junos OS Evolved: An attacker causes rpd crash and denial of service when EVPN is configured

CVE-2026-101942High

Junos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route signaling is used

CVE-2026-101941High

Junos OS and Junos OS Evolved: An attacker causes an rpd crash when routing-policy resolution-map processing and policy event tracing are enabled

CVE-2026-101940High

Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP ISO-VPN egress protection is enabled

CVE-2026-101939High

Junos OS and Junos OS Evolved: A routing-policy table reference causes routing-daemon denial of service when source-based forwarding is used

CVE-2026-101938Medium

Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used

CVE-2026-101937Medium

Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is used

CVE-2026-101936Medium

Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is enabled

CVE-2026-101934Medium

Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventd

CVE-2026-101927High

Junos OS and Junos OS Evolved: An unprivileged local attacker causes denial of service or privilege escalation

CVE-2026-101984Medium

Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when labeled-unicast aggregate-label is configured

CVE-2026-101987Medium

Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is used

CVE-2026-101988Medium

Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker causes an rpd crash when LDP is enabled

CVE-2026-101989Medium

Junos OS and Junos OS Evolved: An crafted LDP message causes an rpd crash when LDP is enabled

CVE-2026-101990Critical

Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised

CVE-2026-101992Medium

Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when automatic VPLS site ID is used

CVE-2026-101993Medium

Junos OS and Junos OS Evolved: An eBGP peer causes an rpd crash when VPLS automatic site-ID collision resolution is used

CVE-2026-101994High

Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald heap disclosure or crash

CVE-2026-101996Medium

Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash when MC-LAG is configured

CVE-2026-102064High

Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer

CVE-2026-102066Medium

Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface

CVE-2026-102071Medium

Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet

CVE-2026-101950Critical

Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Secure Vector Routing is enabled

CVE-2026-101955High

Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used

CVE-2026-101997High

Junos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile authentication