Juniper Networks Security Advisories & CVEs
227 advisories tracked · Juniper SIRT (JSA) via NVD · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Juniper CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Check if your Juniper device is affected
Pick your product and enter the exact software release it runs. We match it against the affected/fixed versions in Juniper's recent advisories.
Official source
Juniper SIRT (JSA) via NVD
Juniper's advisory portal (kb.juniper.net) is a login-walled Salesforce app, so VulniPulse ingests Juniper SIRT (JSA) advisories from NVD, filtered to Juniper's own CNA ([email protected]) — official, machine-readable data with the affected Junos releases in each description. Junos on SRX/MX/EX/QFX and Junos Space are the common targets.
Latest Juniper advisories
Medium [CVE-2026-101970] Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used
A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.
Medium [CVE-2026-101969] Junos OS and Junos OS Evolved: An unauthenticated attacker causes rpd denial of service when IPv6 PIM is enabled
An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface.
Medium [CVE-2026-101968] Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd heap memory disclosure when Rosen-MVPN data-MDT is enabled
An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory disclosure and multicast join-state injection via a malformed Rosen-MVPN message. This issue only affects platforms that support draft Rosen MVPN, such as the ACX Series, EX Series, and MX Series.
Medium [CVE-2026-101938] Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used
An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session.
Medium [CVE-2026-101937] Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is used
A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic.
Medium [CVE-2026-101936] Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is enabled
A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces.
Medium [CVE-2026-101934] Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventd
An Out-of-bounds Write vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved allows a local attacker to cause a Denial of Service (DoS) via sending a crafted packet to the eventd relay service.
Medium [CVE-2026-101984] Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when labeled-unicast aggregate-label is configured
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured.
Medium [CVE-2026-101987] Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is used
An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service by sending a specific IS-IS SRv6 packet when SRv6 and Flexible Algorithm are enabled.
Medium [CVE-2026-101988] Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker causes an rpd crash when LDP is enabled
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session.
Medium [CVE-2026-101989] Junos OS and Junos OS Evolved: An crafted LDP message causes an rpd crash when LDP is enabled
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash via a crafted LDP message.
Medium [CVE-2026-101992] Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when automatic VPLS site ID is used
An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP peer to cause an rpd crash via a BGP VPLS signaling update.
Medium [CVE-2026-101993] Junos OS and Junos OS Evolved: An eBGP peer causes an rpd crash when VPLS automatic site-ID collision resolution is used
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a denial of service via a VPLS signaling update when automatic site-ID negotiation is enabled.
Medium [CVE-2026-101996] Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash when MC-LAG is configured
A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message.
Medium [CVE-2026-102066] Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface.
Medium [CVE-2026-102071] Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet.
Medium [CVE-2026-102078] Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS)
A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control. This issue affects Junos OS on SRX Series: - All versions before 23.2R2-S5; - from 23.4 before 23.4R2-S6; - from 25.2 before 25.2R1-S1, 25.2R2.
Medium [CVE-2026-102080] Improper Resource Locking vulnerability in the clock synchronization daemon (clksyncd) of Juniper Networks Junos OS on MX Series allows a unauthenticated, logically adjacent attacker to cause a Denial-of-Service (DoS)
An Improper Resource Locking vulnerability in the clock synchronization daemon (clksyncd) of Juniper Networks Junos OS on MX Series allows a unauthenticated, logically adjacent attacker to cause a Denial-of-Service (DoS). If a SyncE or PTP upstream node sends a malformed message to an MX device equipped with SCBE3, a false 19.44MHz alarm is generated on the master RE. This leads to persistent RE switchovers and a clksyncd process crash. This issue is outside the attacker's direct control as it's a race condition. This issue affects Junos OS on MX Series: - All versions before 23.2R2-S7.7; - 23.4 versions before 23.4R2-S8.13; - 25.4 versions before 25.4R1-S2.
Medium [CVE-2026-102082] Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS)
An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS). This issue is will occur when 'ssl-proxy' is configured on SRX platforms and during a TLS session-resumption attempt a specifically malformed TLS message is received. This results in an invalid pointer access and PFE crash which causes a temporary loss of traffic forwarding until the PFE automatically recovers. The exact internal timing to trigger this issue is outside the attacker's direct control. This issue affects Junos OS on SRX Series: - All versions before 23.2R2-S5; - 23.4 versions before 23.4R2-S5;
Medium [CVE-2026-102083] Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS)
An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When UTM WebFiltering is configured and the WebFiltering cloud server is unreachable, sustained HTTP traffic load may cause the UTM subsystem to crash and restart, which will lead to a complete service outage until the system has recovered. When category lookup requests cannot be completed, they accumulate internally. Under high load and specific timing conditions, an invalid internal state can occur during cleanup of pending WebFiltering lookups, resulting in a crash of the UTM process. This issue applies to both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF). This issue affects Junos OS on SRX Series: - 23.2 versions from 23.2R2 before 23.2R2-S7.7; - 23.4 versions from 23.4R2 before 23.4R2-S8.13;