Product Affected

These issues affect all versions of Junos OS. These issues affect all versions of Junos OS Evolved.
Critical

CVSS: v3.1: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS: v4.0: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/V:C/RE:M/U:Red)

Problem

Multiple vulnerabilities have been resolved in the Juniper Networks Junos OS and Junos OS Evolved. These issues were found during extensive internal product security testing.

These issues affect:

Junos OS:

  • All versions before 23.2R2-S7.7;
  • from 23.4 before 23.4R2-S8.13;
  • from 24.2 before 24.2R2-S5.5;
  • from 24.4 before 24.4R2-S5;
  • from 25.2 before 25.2R2-S2;
  • from 25.4 before 25.4R1-S3;
  • from 26.2 before 26.2R1-S2;


Junos OS Evolved:

  • All versions before 23.2R2-S7.7-EVO;
  • from 23.4 before 23.4R2-S8.11-EVO;
  • from 24.2 before 24.2R2-S5.6-EVO;
  • from 24.4 before 24.4R2-S5-EVO;
  • from 25.2 before 25.2R2-S2-EVO;
  • from 25.4 before 25.4R1-S3-EVO;
  • from 26.2 before 26.2R1-S2-EVO;
  • 23.4X100-EVO;
  • from 25.2X100 before 25.2X100-D35-EVO;
  • from 25.4X300 before 25.4X300-D40-EVO;

 

Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

 

Important security issues resolved include:

CVECVSSSummary
CVE-2026-1019637.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used
CVE-2026-1019517.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash if a malformed MCAST-TREE NLRI is received and readvertised
CVE-2026-1019926.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when automatic VPLS site ID is used
CVE-2026-1019909.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised
CVE-2026-1019846.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when labeled-unicast aggregate-label is configured
CVE-2026-1019913.1 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
5.3 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)		Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabled
CVE-2026-1020277.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath next-hops are processed
CVE-2026-1019829.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used
CVE-2026-1021847.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crash
CVE-2026-1019596.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A malformed LSP-ping causes an rpd crash
CVE-2026-1020657.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dynamic tunnels are enabled
CVE-2026-1019798.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A network attacker causes root-level code execution or denial of service when SNMP and AAA are enabled
CVE-2026-1019577.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A remote BGP peer causes an rpd crash when long-lived graceful restart (LLGR) is used
CVE-2026-1020598.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: EX Series, SRX Series, QFX Series: A rogue DHCP server causes root-level command execution when the phone-home client processes specific information
CVE-2026-1019397.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: A routing-policy table reference causes routing-daemon denial of service when source-based forwarding is used
CVE-2026-1019487.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A specific BGP FlowSpec update causes an rpd crash when BGP FlowSpec import policy is used
CVE-2026-1019527.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabled
CVE-2026-1019617.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when an ECMP qualifier is used in an import policy
CVE-2026-1019777.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when ephemeral configuration is used
CVE-2026-1019876.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is used
CVE-2026-1020676.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: A specific RSVP packet causes an rpd crash when L2 LSP support is used
CVE-2026-1020508.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of service when LLDP is enabled
CVE-2026-1019818.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when LDP is enabled
CVE-2026-1019646.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP message
CVE-2026-1020586.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes a bfdd denial of service when BFD is enabled
CVE-2026-1019437.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes rpd crash and denial of service when EVPN is configured
CVE-2026-1020356.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes a denial of service when MC-LAG IRB MAC synchronization is enabled
CVE-2026-1020447.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes a routing control-plane denial of service when BGP-LS traffic engineering is enabled
CVE-2026-1021797.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP EVPN RIB telemetry is used
CVE-2026-1020247.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP extended-nexthop-tunnel is used
CVE-2026-1021807.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes an rpd crash when BGP RIB streaming telemetry is in use
CVE-2026-1020606.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: MX Series, ACX Series: An attacker causes a routing daemon crash when multicast lawful intercept is used
CVE-2026-1020416.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when RSVP is enabled
CVE-2026-1020287.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes an rpd crash when VPLS auto-discovery is used
CVE-2026-1021857.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when EVPN multihoming preference-based DF election is used
CVE-2026-1020167.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes a routing outage when BGP MVPN signaling is enabled
CVE-2026-1019447.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes a routing protocol daemon denial of service when EVPN is used
CVE-2026-1019407.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP ISO-VPN egress protection is enabled
CVE-2026-337957.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP Prefix-SID routes are re-advertised
CVE-2026-1020267.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is used
CVE-2026-1019417.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes an rpd crash when routing-policy resolution-map processing and policy event tracing are enabled
CVE-2026-1020227.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when BGP-LS traffic-engineering is enabled
CVE-2026-1020436.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when MPLS-TE fast reroute is enabled
CVE-2026-1019427.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route signaling is used
CVE-2026-1020647.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: An attacker causes an rpd crash when inter-AS MVPN ingress replication is used
CVE-2026-1020257.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: A BGP route-processing error causes rpd crash when extended next-hop tunneling and SRv6 service processing are used
CVE-2026-1020207.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when BGP-LS TED export is enabled
CVE-2026-1020567.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes denial of service and information disclosure when Ethernet CFM is enabled
CVE-2026-1020336.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes denial of service when MC-LAG MAC synchronization is enabled
CVE-2026-1020528.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-client feature is used
CVE-2026-1020346.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LAG ICCP MAC synchronization is enabled
CVE-2026-1020498.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code execution when Unified Access Policy is enabled
CVE-2026-1020476.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes l2cpd denial of service when MVRP is used
CVE-2026-1020516.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion when LLDP fast receive processing is enabled
CVE-2026-1020134.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
6.7 (CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes na-grpcd to crash when the InitialSync service is used
CVE-2026-1020558.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M)		Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remote code execution and denial of service when enhanced CFM is enabled
CVE-2026-1021759.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is used
CVE-2026-1019839.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured
CVE-2026-337969.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled
CVE-2026-1020158.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes root code execution when 802.1X authentication is used
CVE-2026-1020618.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes root code execution when SZTP DHCP provisioning is used
CVE-2026-1019457.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes routing daemon denial of service when EVPN BGP is enabled
CVE-2026-1019716.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: An attacker causes routing protocol daemon crash when OSPFv3 is enabled
CVE-2026-1020297.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when an MSDP or PIM policy uses AS-path expansion
CVE-2026-1020307.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used
CVE-2026-1020176.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes routing-plane denial of service when Auto-RP mapping is enabled
CVE-2026-1020396.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes routing-process denial of service when GMPLS EVPL dynamic transport is used
CVE-2026-1019685.4 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
5.3 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd heap memory disclosure when Rosen-MVPN data-MDT is enabled
CVE-2026-1019463.5 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
5.3 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosure when IPv6 LDP is used
CVE-2026-1019996.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled
CVE-2026-1020006.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled
CVE-2026-1020116.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP link protection is enabled
CVE-2026-1020426.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP associated-bidirectional LSP is enabled
CVE-2026-1020406.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker crashes the routing daemon when co-routed bidirectional RSVP LSPs are used
CVE-2026-1019627.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used
CVE-2026-1019896.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: An crafted LDP message causes an rpd crash when LDP is enabled
CVE-2026-1019936.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: An eBGP peer causes an rpd crash when VPLS automatic site-ID collision resolution is used
CVE-2026-1020367.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An EVPN default-gateway route burst causes l2ald denial of service
CVE-2026-1020535.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used
CVE-2026-1021777.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
7.2 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An out-of-bounds write causes an rpd crash when IS-IS backup selection is used
CVE-2026-1019886.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker causes an rpd crash when LDP is enabled
CVE-2026-1019696.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An unauthenticated attacker causes rpd denial of service when IPv6 PIM is enabled
CVE-2026-1019277.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
8.6 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:N/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An unprivileged local attacker causes denial of service or privilege escalation
CVE-2026-1039936.8 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
6.9 (CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:M)		Junos OS and Junos OS Evolved: If a specific set of BGP communities is present and graceful-shutdown sender is added while attempting to advertise rpd crashes
CVE-2026-1021837.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: If in a BGP EVPN scenario a malformed NLRI is received rpd crashes
CVE-2026-1019756.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: Improper OSPF LSA validation causes an rpd crash when prefix-SID best-route installation is used
CVE-2026-1019767.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: In a non-4byte-AS scenario a specific BGP update causes an rpd crash
CVE-2026-1019497.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: In a scenario with VPN-flowspec and BMP monitoring a specific BGP update causes an rpd crash
CVE-2026-1020544.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
5.3 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configured
CVE-2026-1019869.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution
CVE-2026-1019954.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
5.3 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)		Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disclosure and disruption
CVE-2026-1019947.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald heap disclosure or crash
CVE-2026-1019746.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclosure or service disruption when link-local TE processing is used
CVE-2026-1019726.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: Malformed OSPF packets causes routing disruption when OSPF is enabled
CVE-2026-1020186.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: Malformed PIM Bidir DF-Election messages cause routing service disruption when bidirectional PIM is enabled
CVE-2026-1020196.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: Malformed RIPv2 messages cause routing service disruption when RIP is enabled
CVE-2026-1020666.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: Malformed RSVP packet causes a rpd crash when RSVP is enabled
CVE-2026-1020216.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MPLS-TE error processing is enabled
CVE-2026-1019706.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used
CVE-2026-1020716.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: Specific RSVP packet causes an rpd crash when associated bidirectional LSP is enabled
CVE-2026-1019549.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled
CVE-2026-1020326.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: Unintended l2ald memory allocation causes a denial of service when static MAC IP configurations are present
CVE-2026-1021789.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malformed flowspec NLRI causes routing-engine compromise
CVE-2026-337899.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in denial of service
CVE-2026-1019966.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash when MC-LAG is configured
CVE-2026-1019344.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
6.7 (CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventd

 

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was found during internal product security testing or research.

Solution

The following software releases have been updated to resolve this specific issue:

Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.

Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases.

Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

 

These issues are being tracked as 1954029, 1953081, 1954879, 1954857, 1954487, 1954860, 1956239, 1954478, 1952492, 1953397, 1955227, 1954250, 1953394, 1958116, 1953954, 1953064, 1953085, 1953950, 1953062, 1954540, 1955500, 1957368, 1954449, 1954123, 1958106, 1954000, 1956583, 1956673, 1952196, 1956233, 1952197, 1958122, 1956659, 1956248, 1952495, 1956148, 1954001, 1953962, 1952737, 1956236, 1953965, 1956205, 1956665, 1953998, 1955224, 1956235, 1956203, 1957850, 1956578, 1957664, 1956580, 1957363, 1957359, 1957373, 1954180, 1957845, 1951668, 1954482, 1952739, 1956093, 1958129, 1954002, 1958211, 1956260, 1956262, 1956154, 1956651, 1958185, 1954110, 1954119, 1954120, 1954127, 1956663, 1956653, 1953997, 1954547, 1954880, 1956599, 1957705, 1951942, 1954545, 1958191, 1953674, 1933049, 1952476, 1951277, 1953061, 1953065, 1957710, 1954503, 1954888, 1954885, 1951273, 1951247, 1956156, 1956181, 1955230, 1956204, 1958197, 1962883, 1953101, 1956577, 1952192, 1952604, 1954889 and 1953680 which are visible on the Customer Support website.

 

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Workaround

There are no known workarounds for all of these issues.

Refer to the specific CVE records for additional details on potential individual workarounds.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History

2026-10-14: Initial Publication

Related Information