JO
Network Security
Junos OS
On CISA KEVExploited in the wild
933
CVEs
8
On KEV
10.0
Max CVSS
141
New 30D
Severity mix
Critical 52High 394Medium 54Low 0
Watch
Add Junos OS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-1271 | 7.8 | Apr 15 | Juniper Junos OS before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R11, 12.3X48 before 12.3X48-D25, 13.2 before 13.2R8, 13.3 before 13.3R7, 14.1 before 14.1R6, 14.2… Affected: through 12.1x46; 12.1x47; 12.1x47; 12.1x47; 12.1x47; 12.1x47; +34 more |
| CVE-2026-102177 | 7.6 | Oct 14 | Junos OS and Junos OS Evolved: An out-of-bounds write causes an rpd crash when IS-IS backup selection is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101952 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101949 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: In a scenario with VPN-flowspec and BMP monitoring a specific BGP update causes an rpd crash Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101963 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used Affected: 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2 |
| CVE-2026-101962 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101961 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when an ECMP qualifier is used in an import policy Affected: 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2 |
| CVE-2026-101976 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: In a non-4byte-AS scenario a specific BGP update causes an rpd crash Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102077 | 7.5 | Oct 14 | Junos OS: MX Series with SPC3: In a source NAT scenario malformed packets will lead to resource leaks and eventually traffic stops Affected: before 23.2R2-S4; 23.4 before 23.4R2-S5; 24.2 before 24.2R2 |
| CVE-2026-33795 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP Prefix-SID routes are re-advertised Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102185 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when EVPN multihoming preference-based DF election is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102184 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crash Affected: 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2 |
| CVE-2026-102183 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: If in a BGP EVPN scenario a malformed NLRI is received rpd crashes Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102180 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes an rpd crash when BGP RIB streaming telemetry is in use Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102179 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP EVPN RIB telemetry is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102057 | 7.5 | Oct 14 | Junos OS: An attacker causes DHCP service disruption during DHCP client operation Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102046 | 7.5 | Oct 14 | Junos OS: MX Series: An attacker causes a Routing Engine denial of service when SCTP service is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102044 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes a routing control-plane denial of service when BGP-LS traffic engineering is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102036 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An EVPN default-gateway route burst causes l2ald denial of service Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102030 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102029 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when an MSDP or PIM policy uses AS-path expansion Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102028 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes an rpd crash when VPLS auto-discovery is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102027 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath next-hops are processed Affected: 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2 |
| CVE-2026-102026 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102025 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: A BGP route-processing error causes rpd crash when extended next-hop tunneling and SRv6 service processing are used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102024 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP extended-nexthop-tunnel is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102022 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when BGP-LS traffic-engineering is enabled Affected: 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2 |
| CVE-2026-102020 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when BGP-LS TED export is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102016 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes a routing outage when BGP MVPN signaling is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101945 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes routing daemon denial of service when EVPN BGP is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101944 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes a routing protocol daemon denial of service when EVPN is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101943 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes rpd crash and denial of service when EVPN is configured Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101942 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route signaling is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101941 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes an rpd crash when routing-policy resolution-map processing and policy event tracing are enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101940 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP ISO-VPN egress protection is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101939 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: A routing-policy table reference causes routing-daemon denial of service when source-based forwarding is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102064 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes an rpd crash when inter-AS MVPN ingress replication is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102081 | 7.5 | Oct 14 | Junos OS: SRX4000 Series, SRX5000 Series and MX Series with SPC3: With application services configured, high session churn causes memory leak which will ultimately impact traffic Affected: 23.4R2-S3 before 23.4R2-S7; 24.2R2 before 24.2R2-S3; 24.4 before 24.4R2-S3; 25.2 before 25.2R1-S2, 25.2R2 |
| CVE-2026-101951 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash if a malformed MCAST-TREE NLRI is received and readvertised Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101957 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: A remote BGP peer causes an rpd crash when long-lived graceful restart (LLGR) is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102065 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dynamic tunnels are enabled Affected: 23.4; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2 |
| CVE-2026-101948 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: A specific BGP FlowSpec update causes an rpd crash when BGP FlowSpec import policy is used Affected: 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2 |
| CVE-2026-101977 | 7.5 | Oct 14 | Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when ephemeral configuration is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102070 | 7.5 | Oct 14 | Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101973 | 7.5 | Oct 14 | Junos OS: Malformed packet causes pkid denial of service when certificate re-enrollment is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-57026 | 7.5 | Jul 9 | Junos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invite causes a flowd crash Affected: before 23.2R2-S7; 23.4 before 23.4R2-S8; 24.2 before 24.2R2-S5; 24.4 before 24.4R2-S4; 25.2 before 25.2R2; 25.4 before 25.4R1-S2 |
| CVE-2026-57023 | 7.5 | Jul 9 | Junos OS: MX with SPC3, SRX Series: A specifically malformed TCP packet causes a flowd crash Affected: 23.4 before 23.4R2-S7; 24.2 before 24.2R2-S4; 24.4 before 24.4R2-S3; 25.2 before 25.2R2 |
| CVE-2026-33790 | 7.5 | Apr 9 | Junos OS: SRX Series: In a NAT64 configuration, receipt of a specific, malformed ICMPv6 packet will cause the srxpfe process to crash and restart. Affected: before 21.2R3-S10; 21.4 before 21.4R3-S12; 22.2 before 22.2R3-S8; 22.4 before 22.4R3-S9; 23.2 before 23.2R2-S6; 23.4 before 23.4R2-S7; +6 more |
| CVE-2026-33778 | 7.5 | Apr 9 | Junos OS: SRX Series, MX Series: When a specifically malformed first ISAKMP packet is received kmd/iked crashes Affected: before 22.4R3-S9; 23.2 before 23.2R2-S6; 23.4 before 23.4R2-S7; 24.2 before 24.2R2-S4; 24.4 before 24.4R2-S3; 25.2 before 25.2R1-S2, 25.2R2 |
| CVE-2026-21920 | 7.5 | Jan 15 | Junos OS: SRX Series: If a specific request is processed by the DNS subsystem flowd will crash Affected: 23.4 before 23.4R2-S5; 24.2 before 24.2R2-S1; 24.4 before 24.4R2 |
The 500 most important CVEs for this product (exploited first, then by severity)