Product Affected

These issues affect all versions of Junos OS Evolved.
Critical

CVSS: v3.1: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS: v4.0: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/V:C/RE:M)

Problem

Multiple vulnerabilities have been resolved in the Juniper Networks Junos OS Evolved. These issues were found during extensive internal product security testing.

These issues affect Junos OS Evolved:

  • All versions before 23.2R2-S7.7-EVO;
  • from 23.4 before 23.4R2-S8.11-EVO;
  • from 24.2 before 24.2R2-S5.6-EVO;
  • from 24.4 before 24.4R2-S5-EVO;
  • from 25.2 before 25.2R2-S2-EVO;
  • from 25.4 before 25.4R1-S3-EVO;
  • from 26.2 before 26.2R1-S2-EVO;
  • 23.4X100-EVO;
  • from 25.2X100 before 25.2X100-D35-EVO;
  • from 25.4X300 before 25.4X300-D40-EVO;

 

Note: For Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Important security issues resolved include:

CVECVSSSummary
CVE-2026-1019668.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS Evolved: A crafted analytics sensor resource causes telemetry dial-out daemon denial of service
CVE-2026-1020319.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled
CVE-2026-1020237.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS Evolved: An attacker causes denial of service via SNMP when firewall counters are used
CVE-2026-1020127.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS Evolved: An attacker causes na-grpcd to crash when gRPC telemetry is enabled
CVE-2026-1019658.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabled
CVE-2026-1020456.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS Evolved: An crafted LACP frame causes lacpd to crash when LACP is enabled
CVE-2026-1020687.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
9.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:H/SI:N/SA:L)		Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP key-chain authentication is used
CVE-2026-1019678.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.3 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H)		Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used
CVE-2026-1019788.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS Evolved: PTX Series: An attacker controlled gRPC response causes root-level compromise when zero-touch provisioning is used
CVE-2026-1019856.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS Evolved: PTX Series: An IS-IS peer causes an rpd crash when BIER over IS-IS is enabled
CVE-2026-1019606.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)		Junos OS Evolved: QFX Series: A BGP peer causes an rpd crash when global load balancing is enabled

 

Juniper SIRT is not aware of any malicious exploitation of these vulnerabilities.

These issues were found during internal product security testing or research.

Solution

The following software releases have been updated to resolve this specific issue:

Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases.

Note: For Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

This issue is being tracked as 1954179, 1956332, 1956227, 1954178, 1954177, 1956919, 1955807, 1954221, 1954222, 1954493 and 1953399 which are visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).



Workaround

There are no known workarounds for all of these issues.

Refer to the specific CVE records for additional details on potential individual workarounds.



Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History

2026-10-14: Initial Publication 

Related Information