Product Affected

These issues affect all versions of Junos OS.
Critical

CVSS: v3.1: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 
CVSS: v4.0: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/V:C/RE:M/U:Red)

Problem

Multiple vulnerabilities have been resolved in the Juniper Networks Junos OS. These issues were found during extensive internal product security testing.

These issues affect:

Junos OS:

  • All versions before 23.2R2-S7.7;
  • from 23.4 before 23.4R2-S8.13;
  • from 24.2 before 24.2R2-S5.5;
  • from 24.4 before 24.4R2-S5;
  • from 25.2 before 25.2R2-S2;
  • from 25.4 before 25.4R1-S3;
  • from 26.2 before 26.2R1-S2;

Note: For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

 

Important security issues resolved include:

CVECVSSSummary
CVE-2026-1019809.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Echo is enabled
CVE-2026-1019569.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS: Unauthorized root command execution when J-Web is enabled
CVE-2026-1019737.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS: Malformed packet causes pkid denial of service when certificate re-enrollment is used
CVE-2026-1039948.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS: A crafted OVSDB message crashes vgd and allows remote code execution
CVE-2026-1020707.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
9.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H)		Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is used
CVE-2026-1021768.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS: Specific packets cause SDK service crash or Routing Engine compromise when the SDK service and JDAF is enabled
CVE-2026-1020148.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS: An attacker causes authd to crash when subscriber RADIUS authentication is used
CVE-2026-1020486.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS: An attacker causes l2cpd crash when FNP is used with VLAN-VPLS encapsulation enabled
CVE-2026-1020698.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS: An ICCP peer causes dot1xd to crash when dot1x synchronization is enabled
CVE-2026-1020577.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS: An attacker causes DHCP service disruption during DHCP client operation
CVE-2026-1020726.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS: An authenticated attacker causes a denial of service when the gRPC extension-service is enabled

 

Juniper SIRT is not aware of any malicious exploitation of these vulnerabilities.

These issues were found during internal product security testing or research.

Solution

The following software releases have been updated to resolve these specific issues:

Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.

Note: For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

These issues are being tracked as 1953328, 1951251, 1954427, 1950782, 1958232, 1951698, 1954232, 1957361, 1955815, 1957862 and 1963718 which are visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Workaround

There are no known workarounds for all of these issues.

Refer to the specific CVE records for additional details on potential individual workarounds.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History

2026-10-14: Initial Publication

Related Information