Alert Type

SRN - Software Release Notification
Low/NotificationSoftware Release Notification
Low/NotificationSoftware Release Notification

Product Affected

JUNOS platforms except EX4200 and EX5200

Alert Description

Junos Software Service Release version 26.2R1-S2 is now available for download from the Junos software download site

Download Junos Software Service Release:

  1. Go to Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

NOTE: Starting on August 30th, 2024, we include PR's severity with each entry. See KB86335 [juniper.net] for the definition of PR's Severity

Junos Selective Update (JSU) feasible

Not applicable

Call to Action

For your review

Solution

 

 

Junos Software service Release version 26.2R1-S2 is now available.

26.2R1-S2 - List of Fixed issues

PR NumberSynopsisCategory: Junos SDK PRs specific to the Services SDK
1951698
Critical		Junos OS: Specific packets cause SDK service crash or Routing Engine compromise when the SDK service and JDAF is enabled (CVE-2026-102176)
Product-Group=junos
Severity=Critical		A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberSynopsisCategory: SRX Fleming Broadcom TD3/SDK, datapath related issue
1943275
Critical		On some SRX platforms configuring global-mode switching where 1G SFP is used on 10G port causes port to go down
Product-Group=junos
Severity=Critical		On SRX1600, SRX2300 and SRX4300 platforms, upon configuring "set protocols l2-learning global-mode switching" where 1G SFP is used on 10G port the port goes down after sometime causing traffic drop. This traffic drop is only subjected to the port where the configuration is applied, thus the other ports remains unaffected.
PR NumberSynopsisCategory: Fabric for LC1300 and SIB3
1964102
Major		Major alarms for fabric link faults that result in reduced fabric capacity are introduced on PTX10004 and PTX10008 platforms
Product-Group=junos
Severity=Major		On Junos OS Evolved PTX10004 and PTX10008 platforms with LC1301 line cards and SF5 fabric, fabric link faults need to be reported as major alarms. Link faults can occur during system operation and result in reduced fabric capacity with partial impact. This enhancement introduces the new alarm "One or more PFE pairs operating with less than acceptable fabric capacity" to indicate reduced fabric capacity conditions.
PR NumberSynopsisCategory: "agentd" software daemon
1954177
Major		Junos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabled (CVE-2026-101965)
Product-Group=junos
Severity=Major		An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1954178
Critical		Junos OS Evolved: An attacker causes na-grpcd to crash when gRPC telemetry is enabled (CVE-2026-102012)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS and Junos EVO allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1954180
Critical		Junos OS and Junos OS Evolved: An attacker causes na-grpcd to crash when the InitialSync service is used (CVE-2026-102013)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the na-grpcd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker with access to the chassis-internal network to cause a denial of service via a network message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Application Quality of Experience
PR NumberSynopsisCategory: Bi Directional Forwarding Detection (BFD)
1958106
Critical		Junos OS and Junos OS Evolved: An attacker causes a bfdd denial of service when BFD is enabled (CVE-2026-102058)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Border Gateway Protocol
1952197
Critical		Junos OS and Junos OS Evolved: An attacker causes an rpd crash when BGP RIB streaming telemetry is in use (CVE-2026-102180)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952737
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP Prefix-SID routes are re-advertised (CVE-2026-33795)
Product-Group=junos
Severity=Critical		A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953061
Critical		Junos OS and Junos OS Evolved: In a non-4byte-AS scenario a specific BGP update causes an rpd crash (CVE-2026-101976)
Product-Group=junos
Severity=Critical		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953065
Critical		Junos OS and Junos OS Evolved: In a scenario with VPN-flowspec and BMP monitoring a specific BGP update causes an rpd crash (CVE-2026-101949)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953085
Critical		Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabled (CVE-2026-101952)
Product-Group=junos
Severity=Critical		An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953394
Critical		Junos OS and Junos OS Evolved: A remote BGP peer causes an rpd crash when long-lived graceful restart (LLGR) is used (CVE-2026-101957)
Product-Group=junos
Severity=Critical		An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953397
Critical		Junos OS and Junos OS Evolved: A malformed LSP-ping causes an rpd crash (CVE-2026-101959)
Product-Group=junos
Severity=Critical		A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953950
Critical		Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when an ECMP qualifier is used in an import policy (CVE-2026-101961)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953962
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP ISO-VPN egress protection is enabled (CVE-2026-101940)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954000
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd crash and denial of service when EVPN is configured (CVE-2026-101943)
Product-Group=junos
Severity=Critical		An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a crafted BGP EVPN update message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954487
Major		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when labeled-unicast aggregate-label is configured (CVE-2026-101984)
Product-Group=junos
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954857
Critical		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised (CVE-2026-101990)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash or, on Junos OS, remote code-execution via sending a flow-spec update selected for re-advertisement. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954860
Critical		Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabled (CVE-2026-101991)
Product-Group=junos
Severity=Critical		An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause heap data disclosure via a malformed UPDATE sent over a session with the traffic-engineering address family enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956236
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is used (CVE-2026-102026)
Product-Group=junos
Severity=Critical		An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a routing-daemon crash via a BGP route update when RIB sharding is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: BGP BMP Software
1952211
Critical		Junos OS and Junos OS Evolved: Malformed BMP messages cause rpd CPU exhaustion or a crash (CVE-2026-102181)
Product-Group=junos
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in BGP Monitoring Protocol (BMP) message-processing of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause routing protocol daemon (rpd) CPU exhaustion or a crash via malformed BMP messages. Please refer to https://supportportal.juniper.net/JSAxx for more information.
1952604
Critical		Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in denial of service (CVE-2026-33789)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952739
Critical		Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled (CVE-2026-33796)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: BBE Remote Access Server
1954232
Critical		Junos OS: An attacker causes authd to crash when subscriber RADIUS authentication is used (CVE-2026-102014)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberSynopsisCategory: QFX Access Control related
1955815
Major		Junos OS: An ICCP peer causes dot1xd to crash when dot1x synchronization is enabled (CVE-2026-102069)
Product-Group=junos
Severity=Major		A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is triggered when dot1x synchronization is enabled for the required Fusion satellite topology. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
1956093
Critical		Junos OS and Junos OS Evolved: An attacker causes root code execution when 802.1X authentication is used (CVE-2026-102015)
Product-Group=junos
Severity=Critical		A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: EVO cfmd RE related PRs
1957845
Critical		Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remote code execution and denial of service when enhanced CFM is enabled (CVE-2026-102055)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent to a configured down-MEP with enhanced CFM mode enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957850
Critical		Junos OS and Junos OS Evolved: An attacker causes denial of service and information disclosure when Ethernet CFM is enabled (CVE-2026-102056)
Product-Group=junos
Severity=Critical		An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Firewall related development
1956227
Critical		Junos OS Evolved: An attacker causes denial of service via SNMP when firewall counters are used (CVE-2026-102023)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberSynopsisCategory: EVO Socket replication
1955807
Critical		Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP key-chain authentication is used (CVE-2026-102068)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP SYN packet when key-chain authentication is used for BGP or LDP. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberSynopsisCategory: AAA, auditd issues
1956332
Critical		Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled (CVE-2026-102031)
Product-Group=junos
Severity=Critical		An OS Command Injection vulnerability in tacacs of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberSynopsisCategory: eventd, syslog infra issues
1953680
Critical		Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventd (CVE-2026-101934)
Product-Group=junos
Severity=Critical		An Out-of-bounds Write vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved allows a local attacker to cause a Denial of Service (DoS) via sending a crafted packet to the eventd relay service. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: EVPN control plane issues
1952196
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP EVPN RIB telemetry is used (CVE-2026-102179)
Product-Group=junos
Severity=Critical		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Successful exploitation can crash rpd and interrupt routing protocols until the daemon restarts and reconverges. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952492
Critical		Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crash (CVE-2026-102184)
Product-Group=junos
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update. The result is a denial of service affecting routing adjacencies. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952495
Critical		Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when EVPN multihoming preference-based DF election is used (CVE-2026-102185)
Product-Group=junos
Severity=Critical		A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953998
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route signaling is used (CVE-2026-101942)
Product-Group=junos
Severity=Critical		An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954001
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing protocol daemon denial of service when EVPN is used (CVE-2026-101944)
Product-Group=junos
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of service via specially crafted EVPN route updates from an accepted EVPN BGP peer. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954002
Critical		Junos OS and Junos OS Evolved: An attacker causes routing daemon denial of service when EVPN BGP is enabled (CVE-2026-101945)
Product-Group=junos
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954029
Major		Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used (CVE-2026-101963)
Product-Group=junos
Severity=Major		An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954478
Critical		Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used (CVE-2026-101982)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Control plane EVPN multicast
1953997
Major		Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used (CVE-2026-101962)
Product-Group=junos
Severity=Major		An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1979980
Major		Multicast traffic from source connected to PEG device that is PIM Non-DR in IRB interface of SBD is not forwarded to the receivers connected to SL devices
Product-Group=junos
Severity=Major		Multicast traffic from source connected to PEG (PIM EVPN Gateway) device that is PIM Non-DR in IRB interface of SBD (Supplemental Bridge Domain) is not forwarded to the receivers connected to SL (Server Leaf) devices. The problem impacts only EX5200 platforms, the other platforms are not impacted.
PR NumberSynopsisCategory: EX interfaces issues
1923212
Major		PFE process crash occurs during EX4k boot-up
Product-Group=junos
Severity=Major		On EX4400/4100 platforms, PFE process (fxpc) crash occurs with a segmentation fault (SIGSEGV) during device boot-up. The crash occurs during the Broadcom PHY firmware broadcast download sequence when initializing the external PHY. No service impact as this crash happens at initial boot cycle.
PR NumberSynopsisCategory: SRX4100/SRX4200 platform software
1963533
Major		An operationally down interface might trigger "DPDK port is stuck with hardware issue!!!" error log
Product-Group=junosvae
Severity=Major		On SRX4100 and SRX4200, if a physical interface that transitions to the operationally down state and remains down during the next 60-second, Data Plane Development Kit (DPDK) monitoring cycle might be incorrectly reported as transmit (Tx) stuck. This condition triggers a Flexible PIC Concentrator (FPC) major alarm and redundancy group failover if you configure the chassis cluster, which might result in temporary traffic disruption. The issue is resolved by excluding operationally down interfaces from DPDK Tx-stuck monitoring.
PR NumberSynopsisCategory: N/A:sw-grpc-dialout:
1954179
Major		Junos OS Evolved: A crafted analytics sensor resource causes telemetry dial-out daemon denial of service (CVE-2026-101966)
Product-Group=junos
Severity=Major		A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberSynopsisCategory: Internet Group Management Protocol
1958122
Critical		Junos OS and Junos OS Evolved: MX Series, ACX Series: An attacker causes a routing daemon crash when multicast lawful intercept is used (CVE-2026-102060)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: ISIS routing protocol
1954540
Critical		Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is used (CVE-2026-101987)
Product-Group=junos
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service by sending a specific IS-IS SRv6 packet when SRv6 and Flexible Algorithm are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: ISSU control procedure
1947573
Minor		ISSU will abort on EX-4400, EX-4100 and EX-4000 if any ISSU incompatible configurations are detected on the device.
Product-Group=junos
Severity=Minor		During ISSU image validation, SW will now check for any ISSU incompatible configurations configured on the device.
PR NumberSynopsisCategory: Category for JET(JUNOS Extension Toolkit) related issues
1963718
Major		Junos OS: An authenticated attacker causes a denial of service when the gRPC extension-service is enabled (CVE-2026-102072)
Product-Group=junos
Severity=Major		An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to cause a denial of service via a compressed gRPC request. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberSynopsisCategory: N/A:sw-jsr-flowd-datapath:
1953078
Critical		Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Secure Vector Routing is enabled (CVE-2026-101950)
Product-Group=junos
Severity=Critical		A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets reaching an interface configured for Secure Vector Routing. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
1953764
Critical		Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used (CVE-2026-101938)
Product-Group=junos
Severity=Critical		An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberSynopsisCategory: SRX Firewall Authentication
1953636
Critical		Junos OS and Junos OS Evolved: SRX Series: An attacker causes remote code execution when SRX chassis-cluster is enabled (CVE-2026-33798)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
1953761
Critical		Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is enabled (CVE-2026-101936)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
1953762
Critical		Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is used (CVE-2026-101937)
Product-Group=junos
Severity=Critical		A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberSynopsisCategory: IPSEC/IKE VPN
1951651
Critical		Junos OS: SRX Series: An authenticated remote-access VPN client causes iked denial of service or root-level code execution when JIMS identity publishing is enabled (CVE-2026-102174)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS identity-publishing path. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberSynopsisCategory: Security platform jweb support
1953101
Critical		Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled (CVE-2026-101954)
Product-Group=junos
Severity=Critical		An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953328
Critical		Junos OS: Unauthorized root command execution when J-Web is enabled (CVE-2026-101956)
Product-Group=junos
Severity=Critical		An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
1954482
Critical		Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured (CVE-2026-101983)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954503
Critical		Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution (CVE-2026-101986)
Product-Group=junos
Severity=Critical		An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Key Management Daemon
1952216
Critical		Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution (CVE-2026-102182)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. Please refer to https://supportportal.juniper.net/JSA112196 [juniper.net] for more information.
PR NumberSynopsisCategory: Layer 2 Control Module
1957359
Critical		Junos OS and Junos OS Evolved: An attacker causes l2cpd denial of service when MVRP is used (CVE-2026-102047)
Product-Group=junos
Severity=Critical		An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2 attacker to cause a denial of service in associated Layer 2 control protocols via a crafted MVRP Ethernet frame sent to an MVRP-enabled interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957361
Critical		Junos OS: An attacker causes l2cpd crash when FNP is used with VLAN-VPLS encapsulation enabled (CVE-2026-102048)
Product-Group=junos
Severity=Critical		An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation enabled. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
1957363
Critical		Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code execution when Unified Access Policy is enabled (CVE-2026-102049)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access Policy enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957368
Critical		Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of service when LLDP is enabled (CVE-2026-102050)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated triggering may disrupt LLDP and other Layer 2 control protocols across the device. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957373
Critical		Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion when LLDP fast receive processing is enabled (CVE-2026-102051)
Product-Group=junos
Severity=Critical		An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast receive processing is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Layer2 forwarding on EX/NFX/PTX/QFX
1956577
Critical		Junos OS and Junos OS Evolved: Unintended L2ALD memory allocation causes a denial of service when static MAC IP configurations are present (CVE-2026-102032)
Product-Group=junos
Severity=Critical		A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via crafted packets when the static MAC-IP feature is in use. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956583
Critical		Junos OS and Junos OS Evolved: An attacker causes a denial of service when MC-LAG IRB MAC synchronization is enabled (CVE-2026-102035)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP peer message when MC-LAG IRB MAC synchronization is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956599
Critical		Junos OS and Junos OS Evolved: An EVPN default-gateway route burst causes l2ald denial of service (CVE-2026-102036)
Product-Group=junos
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of service via EVPN Type-2 MAC/IP routes. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957705
Critical		Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used (CVE-2026-102053)
Product-Group=junos
Severity=Critical		An Improper Release of Memory Before Removing Last Reference vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms allows a configured EVPN peer to cause a denial of service through memory exhaustion via EVPN-VXLAN active-active multihoming route processing. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957710
Critical		Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configured (CVE-2026-102054)
Product-Group=junos
Severity=Critical		An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local VTEP. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: lacp protocol
1956919
Critical		Junos OS Evolved: An crafted LACP frame causes lacpd to crash when LACP is enabled (CVE-2026-102045)
Product-Group=junos
Severity=Critical		An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port. Refer to https://supportportal.juniper.net/JSA112250 [juniper.net]
PR NumberSynopsisCategory: Label Distribution Protocol
1954119
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled (CVE-2026-101999)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session carrying an IPv6 Prefix FEC in a specific Label message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954120
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled (CVE-2026-102000)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP control traffic. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954127
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP link protection is enabled (CVE-2026-102011)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session when two misconfigured neighbors (or one neighbor duplicated by an L2 loop) advertise the same transport address on a link-protected interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: JDHCP is a daemon for EVO platform to handle DHCP protocol
1957664
Critical		Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-client feature is used (CVE-2026-102052)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957862
Critical		Junos OS: An attacker causes DHCP service disruption during DHCP client operation (CVE-2026-102057)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP client response. The issue affects DHCP client operation and can interrupt related DHCP, relay, and zero-touch-provisioning services. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberSynopsisCategory: mc-ae interface
1954885
Major		Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes L2ALD heap disclosure or crash (CVE-2026-101994)
Product-Group=junos
Severity=Major		An Improper Handling of Length Parameter Inconsistency vulnerability in the L2ALD daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control or impersonate a configured MC-LAG ICCP peer to disclose process heap memory or cause a denial of service via a malformed ICCP message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954888
Major		Junos OS and Junos OS Evolved: Malformed ICCP packets cause L2ALD memory disclosure and disruption (CVE-2026-101995)
Product-Group=junos
Severity=Major		An Improper Validation of Specified Quantity in Input vulnerability in the L2ALD of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker with access to an ICCP peer session to cause memory disclosure and disruption of the L2ALD daemon via malformed ICCP packets. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954889
Major		Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash when MC-LAG is configured (CVE-2026-101996)
Product-Group=junos
Severity=Major		A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956578
Critical		Junos OS and Junos OS Evolved: An attacker causes denial of service when MC-LAG MAC synchronization is enabled (CVE-2026-102033)
Product-Group=junos
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP MC-LAG message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956580
Critical		Junos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LAG ICCP MAC synchronization is enabled (CVE-2026-102034)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured ICCP peer to cause a denial of service via a malformed MC-LAG message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Multiprotocol Label Switching
1956673
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing control-plane denial of service when BGP-LS traffic engineering is enabled (CVE-2026-102044)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Multicast for L3VPNs
1953081
Critical		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash if a malformed MCAST-TREE NLRI is received and readvertised (CVE-2026-101951)
Product-Group=junos
Severity=Critical		An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent configured BGP peer to cause a denial of service by sending a specifically malformed BGP MCAST-TREE update and this NLRI is then attempted to be readvertised. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954493
Major		Junos OS Evolved: PTX Series: An IS-IS peer causes an rpd crash when BIER over IS-IS is enabled (CVE-2026-101985)
Product-Group=junos
Severity=Major		A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1955224
Major		Junos OS and Junos OS Evolved: An attacker causes an rpd crash when inter-AS MVPN ingress replication is used (CVE-2026-102064)
Product-Group=junos
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956148
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing outage when BGP MVPN signaling is enabled (CVE-2026-102016)
Product-Group=junos
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP MVPN peer to cause a denial of service via a BGP MVPN signaling update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956262
Critical		Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used (CVE-2026-102030)
Product-Group=junos
Severity=Critical		An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an interregion segmented VRF with 'protocols mvpn inter-region-template' is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: ISO network family related
1954427
Critical		Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Echo is enabled (CVE-2026-101980)
Product-Group=junos
Severity=Critical		An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberSynopsisCategory: SCTP kernel issues
1957225
Critical		Junos OS: MX Series: An attacker causes a Routing Engine denial of service when SCTP service is used (CVE-2026-102046)
Product-Group=junos
Severity=Critical		A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause a denial of service via crafted SCTP network traffic. Please refer to https://supportportal.juniper.net/JSA112196 [juniper.net] for more information.
PR NumberSynopsisCategory: OSPF routing protocol
1951247
Critical		Junos OS and Junos OS Evolved: Malformed OSPF packets causes routing disruption when OSPF is enabled (CVE-2026-101972)
Product-Group=junos
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1951273
Critical		Junos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclosure or service disruption when link-local TE processing is used (CVE-2026-101974)
Product-Group=junos
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1951277
Critical		Junos OS and Junos OS Evolved: Improper OSPF LSA validation causes an rpd crash when prefix-SID best-route installation is used (CVE-2026-101975)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1958211
Critical		Junos OS and Junos OS Evolved: An attacker causes routing protocol daemon crash when OSPFv3 is enabled (CVE-2026-101971)
Product-Group=junos
Severity=Critical		An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service and heap memory corruption via OSPFv3 messages on an enabled broadcast interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: MPLS Point-to-Multipoint TE
1954123
Major		Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP message (CVE-2026-101964)
Product-Group=junos
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted Label Mapping message received over an established LDP session.Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954449
Major		Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when LDP is enabled (CVE-2026-101981)
Product-Group=junos
Severity=Major		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954545
Major		Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker causes an rpd crash when LDP is enabled (CVE-2026-101988)
Product-Group=junos
Severity=Major		A NULL Pointer Dereference vulnerability in the routing protcol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954547
Major		Junos OS and Junos OS Evolved: An crafted LDP message causes an rpd crash when LDP is enabled (CVE-2026-101989)
Product-Group=junos
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash via a crafted LDP message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Phone-Home-Client Infrastructure
1954221
Critical		Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used (CVE-2026-101967)
Product-Group=junos
Severity=Critical		An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response if the management-instance configuration enabled. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1954222
Critical		Junos OS Evolved: PTX Series: An attacker controlled gRPC response causes root-level compromise when zero-touch provisioning is used (CVE-2026-101978)
Product-Group=junos
Severity=Critical		An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1958116
Critical		Junos OS and Junos OS Evolved: EX Series, SRX Series, QFX Series: A rogue DHCP server causes root-level command execution when the phone-home client processes specific information (CVE-2026-102059)
Product-Group=junos
Severity=Critical		An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1958129
Major		Junos OS and Junos OS Evolved: An attacker causes root code execution when SZTP DHCP provisioning is used (CVE-2026-102061)
Product-Group=junos
Severity=Major		A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Protocol Independant Multicast
1956154
Critical		Junos OS and Junos OS Evolved: An attacker causes routing-plane denial of service when Auto-RP mapping is enabled (CVE-2026-102017)
Product-Group=junos
Severity=Critical		An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of service via Auto-RP mapping announcements received when Auto-RP mapping is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956156
Critical		Junos OS and Junos OS Evolved: Malformed PIM Bidir DF-Election messages cause routing service disruption when bidirectional PIM is enabled (CVE-2026-102018)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed PIM Bidir message. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net]
1958191
Critical		Junos OS and Junos OS Evolved: An unauthenticated attacker causes rpd denial of service when IPv6 PIM is enabled (CVE-2026-101969)
Product-Group=junos
Severity=Critical		An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1958197
Critical		Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used (CVE-2026-101970)
Product-Group=junos
Severity=Critical		A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Issues related to PKI daemon
1951251
Critical		Junos OS: Malformed packet causes pkid denial of service when certificate re-enrollment is used (CVE-2026-101973)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during enrollment or automatic certificate re-enrollment. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberSynopsisCategory: Routing Information Protocol
1956181
Critical		Junos OS and Junos OS Evolved: Malformed RIPv2 messages cause routing service disruption when RIP is enabled (CVE-2026-102019)
Product-Group=junos
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed RIPv2 message. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net]
PR NumberSynopsisCategory: rosen-6 and rosen-7 mvpn bugs
1958185
Major		Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd heap memory disclosure when Rosen-MVPN data-MDT is enabled (CVE-2026-101968)
Product-Group=junos
Severity=Major		An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory disclosure and multicast join-state injection via a malformed Rosen-MVPN message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Issues related to dynamic-tunnels routing infrastructure
1955227
Major		Junos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dynamic tunnels are enabled (CVE-2026-102065)
Product-Group=junos
Severity=Major		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause an rpd crash via a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: RPD Next-hop issues including indirect, CNH, and MCNH
1955220
Minor		Junos OS: MX Series: An unauthenticated network attacker causes an rpd crash when HFRR link protection is used (CVE-2026-102063)
Product-Group=junos
Severity=Minor		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF. Please refer to https://supportportal.juniper.net/JSA112196 [juniper.net] for more information.
PR NumberSynopsisCategory: RPD policy options
1953062
Critical		Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when ephemeral configuration is used (CVE-2026-101977)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent routing-daemon denial of service via a specific BGP packet when ephemeral configuration is used. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953064
Critical		Junos OS and Junos OS Evolved: A specific BGP FlowSpec update causes an rpd crash when BGP FlowSpec import policy is used (CVE-2026-101948)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a denial of service via a specific BGP FlowSpec update received by an affected BGP session. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953954
Critical		Junos OS and Junos OS Evolved: A routing-policy table reference causes routing-daemon denial of service when source-based forwarding is used (CVE-2026-101939)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table ` is configured to reference a routing table that does not exist. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953965
Critical		Junos OS and Junos OS Evolved: An attacker causes an rpd crash when routing-policy resolution-map processing and policy event tracing are enabled (CVE-2026-101941)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP neighbor to cause a denial of service via a BGP route update when specific routing-policy resolution-map and policy event-tracing configuration is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Issues related route resolution routing infrastructure
1956239
Critical		Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath next-hops are processed (CVE-2026-102027)
Product-Group=junos
Severity=Critical		An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: RPD route tables, resolver, routing instances, static routes
1956233
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP extended-nexthop-tunnel is used (CVE-2026-102024)
Product-Group=junos
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956235
Critical		Junos OS and Junos OS Evolved: A BGP route-processing error causes rpd crash when extended next-hop tunneling and SRv6 service processing are used (CVE-2026-102025)
Product-Group=junos
Severity=Critical		A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: multicast source distribution protocol
1956260
Critical		Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when an MSDP or PIM policy uses AS-path expansion (CVE-2026-102029)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Resource Reservation Protocol
1955230
Critical		Junos OS and Junos OS Evolved: Malformed RSVP packet causes a rpd crash when RSVP is enabled (CVE-2026-102066)
Product-Group=junos
Severity=Critical		A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1955500
Major		Junos OS and Junos OS Evolved: A specific RSVP packet causes an rpd crash when L2 LSP support is used (CVE-2026-102067)
Product-Group=junos
Severity=Major		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a crafted RSVP packet when L2 LSP support is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information
1956204
Critical		Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MPLS-TE error processing is enabled (CVE-2026-102021)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956651
Critical		Junos OS and Junos OS Evolved: An attacker causes routing-process denial of service when GMPLS EVPL dynamic transport is used (CVE-2026-102039)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a malformed RSVP Path message received on an EVPL LMP control channel. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956653
Critical		Junos OS and Junos OS Evolved: An attacker crashes the routing daemon when co-routed bidirectional RSVP LSPs are used (CVE-2026-102040)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the routing daemon and cause a denial of service via an RSVP Path message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956659
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when RSVP is enabled (CVE-2026-102041)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a denial of service via malformed RSVP signaling when RSVP is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956663
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP associated-bidirectional LSP is enabled (CVE-2026-102042)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE associated-bidirectional LSP signaling. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1962883
Major		Junos OS and Junos OS Evolved: Specific RSVP packet causes an rpd crash when associated bidirectional LSP is enabled (CVE-2026-102071)
Product-Group=junos
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: RPM and TWAMP
1958232
Major		Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is used (CVE-2026-102070)
Product-Group=junos
Severity=Major		A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information
PR NumberSynopsisCategory: SNMP Infrastructure (snmpd, mib2d)
1954250
Critical		Junos OS and Junos OS Evolved: A network attacker causes root-level code execution or denial of service when SNMP and AAA are enabled (CVE-2026-101979)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Segment routing traffic Engineering
1956203
Critical		Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when BGP-LS TED export is enabled (CVE-2026-102020)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via BGP-LS routing updates. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net]
1956205
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when BGP-LS traffic-engineering is enabled (CVE-2026-102022)
Product-Group=junos
Severity=Critical		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS peer to cause an rpd crash via a crafted BGP-LS Link NLRI advertisements. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: SRX Advanced Anti-Malware module
1955171
Major		Junos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile authentication (CVE-2026-101997)
Product-Group=junos
Severity=Major		An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a configured Security Intelligence feed connection. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
1955172
Major		Junos OS: SRX Series: An compromised HTTPS feed server can cause remote code execution when Security Intelligence is used (CVE-2026-102062)
Product-Group=junos
Severity=Major		An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information
PR NumberSynopsisCategory: SRX branch platforms
1943202
Minor		File copy CLI command fails to resolve remote hostnames when no username is specified
Product-Group=junos
Severity=Minor		On all Junos OS and Junos OS Evolved platforms, when copying a file to a remote host using a hostname, the device is unable to resolve the hostname, causing the file transfer to fail. Secure Copy (SCP) operations are not affected and continue to work as expected. This issue does not impact network services or device functionality.
PR NumberSynopsisCategory: Authentication, Authorization, Accounting, PAM (RADIUS/tacplus)
1977401
Major		Junos OS and Junos OS Evolved platforms experience an mgd process crash when a user assigned to a login class with 'no-hidden-commands' requests CLI help for a single-word command
Product-Group=junos
Severity=Major		On Junos OS and Junos OS Evolved platforms, when a user assigned to a login class configured with 'no-hidden-commands' requests CLI help for a single-word command, such as 'clear?', the mgd process crashes. The CLI session that triggers the issue is terminated, but other user sessions and traffic forwarding are not affected. The system recovers automatically, and the affected user can establish a new CLI session.
PR NumberSynopsisCategory: Junos Automation, Commit/Op/Event and SLAX
1960476
Major		Event script fails during a virtual chassis role change
Product-Group=junos
Severity=Major		Event script failure occurs during a virtual chassis primary role change when the system is unable to load a required component at the time the script is executed.
PR NumberSynopsisCategory: UI Infrastructure - mgd, DAX API, DDL/ODL
1861779
Major		Junos OS and Junos OS Evolved: EX Series, QFX Series, MX Series: A specific 'show l2-learning/ethernet-switching' command causes l2ald crash (CVE-2026-57025)
Product-Group=junos
Severity=Major		A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privilged attacker to cause a Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA110085 [juniper.net] for more information.
1951668
Critical		Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is used (CVE-2026-102175)
Product-Group=junos
Severity=Critical		A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Issues related to Logging/Tracing, errmsg, eventd infrastruc
1953674
Critical		Junos OS and Junos OS Evolved: An unprivileged local attacker causes denial of service or privilege escalation (CVE-2026-101927)
Product-Group=junos
Severity=Critical		A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service (DoS) or achieve privilege escalation to root via crafted IPC event messages. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: anti spam bugs
1953149
Critical		Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used (CVE-2026-101955)
Product-Group=junos
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled.Please refer to the https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberSynopsisCategory: web filterig issues
1956639
Critical		Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used (CVE-2026-102037)
Product-Group=junos
Severity=Critical		An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root priviledges via a malicious response from a configured custom URL-feed server. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberSynopsisCategory: Virtual Private LAN Services
1954879
Major		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when automatic VPLS site ID is used (CVE-2026-101992)
Product-Group=junos
Severity=Major		An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP peer to cause an rpd crash via a BGP VPLS signaling update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954880
Major		Junos OS and Junos OS Evolved: An eBGP peer causes an rpd crash when VPLS automatic site-ID collision resolution is used (CVE-2026-101993)
Product-Group=junos
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a denial of service via a VPLS signaling update when automatic site-ID negotiation is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956248
Critical		Junos OS and Junos OS Evolved: An attacker causes an rpd crash when VPLS auto-discovery is used (CVE-2026-102028)
Product-Group=junos
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.

 

 

Extended Solution

 

 

26.2R1-S2 - List of Known issues

PR NumberSynopsisCategory: Fabric for LC1300 and SIB3
1964102
Major		Major alarms for fabric link faults that result in reduced fabric capacity are introduced on PTX10004 and PTX10008 platforms
Product-Group=junos		On Junos OS Evolved PTX10004 and PTX10008 platforms with LC1301 line cards and SF5 fabric, fabric link faults need to be reported as major alarms. Link faults can occur during system operation and result in reduced fabric capacity with partial impact. This enhancement introduces the new alarm "One or more PFE pairs operating with less than acceptable fabric capacity" to indicate reduced fabric capacity conditions.

Resolved In: evo:24.4R2-S3-C1-EVO evo:24.4R2-S3-J1-EVO evo:24.4R2-S4-EVO evo:24.4R2-S5-EVO evo:25.4R2-EVO evo:26.2R1-S2-EVO evo:26.2R2-EVO evo:26.4R1-EVO evo:27.1R1-EVO junos:25.4R2 junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: MPC10/11/LC9600 Chassis Category
1965224
Major		Incorrect high-temperature readings trigger chassis shutdown
Product-Group=junosvae		An incorrect high-temperature reading from the Intake-B temperature sensor on MX10004 and MX10008 systems running Junos OS with LC9600 line cards triggers an over-temperature condition and causes an automatic chassis shutdown. This results in a complete service outage that requires manual intervention to restore service.

Resolved In: junos:23.2R2-S3-J24 junos:23.2R2-S3-J27 junos:26.4DCB junos:26.4R1
PR NumberSynopsisCategory: Border Gateway Protocol
1933049
Critical		Junos OS and Junos OS Evolved: If a specific set of BGP communities is present and graceful-shutdown sender is added while attempting to advertise rpd crashes (CVE-2026-103993)
Product-Group=junos		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker which sends a specific set of BGP communities to cause a Denial-of-Service (DoS) as rpd crashes when graceful-shutdown sender community is added when attempting to advertise. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.

Resolved In: evo:22.3X50-EVO evo:22.3X50-J5-EVO evo:22.3X80-D49-EVO evo:23.2R2-S7-EVO evo:23.4R2-S8-EVO evo:24.2R2-S5-EVO evo:24.4R2-S4-EVO evo:25.2R2-S1-EVO evo:25.2X100-D35-EVO evo:25.4R1-S2-EVO evo:25.4R2-EVO evo:25.4X300-EVO evo:26.1R1-EVO evo:26.2R1-EVO evo:26.3R1-EVO junos:20.3X75-D443 junos:20.3X75-D52-J3 junos:21.2R3-S11 junos:21.2X33 junos:21.2X34 junos:21.4R3-S12 junos:21.4R3-S12-X1 junos:21.4R3-S13 junos:22.2R3-S8 junos:22.3R3-S5 junos:22.3X60-J4 junos:22.4R3-S10 junos:22.4R3-S9 junos:22.4X50 junos:23.2R2-S7 junos:23.4R2-S8 junos:24.2R2-S5 junos:24.4R2-S4 junos:25.2R2-S1 junos:25.4R1-S2 junos:25.4R2 junos:26.1R1 junos:26.2R1
1969577
Major		The rpd process crashes when deleting BGP VPN routing instances during an active SNMP walk on the RIB
Product-Group=junos		On all Junos OS and Junos OS Evolved platforms, rpd process crash is caused by deleting a routing-instances of type Virtual Routing and Forwarding (VRF) while a Simple Network Management Protocol (SNMP) walk operation is in progress.

Resolved In: evo:23.2R2-S8-EVO evo:25.4R2-EVO evo:26.2R2-EVO evo:26.3R1-EVO evo:26.4R1-EVO junos:23.2R2-S8 junos:25.4R2 junos:26.2R2 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: MX Platform SW - FRU Management
1964581
Minor		Inserted SFB is not correctly shown in "show chassis" output on MX2020/MX2010
Product-Group=junos		On the MX2020/MX2010 platforms, when inserting SFB into empty slot and didn't issue "request chassis sfb slot online", some variants of "show chassis" command cannot correctly show the info of target SFB. After issuing "request chassis sfb offline" and re-inserting the SFB, the i2c_data_sent flag is never set because the SFB is not scheduled for power-on in that path. As a result, chassisd never receives the I2C/IDEEPROM data and the SFB does not appear as "Present" in show chassis hardware models / show chassis environment sfb. There is no service impact.

Resolved In: junos:25.4R2 junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: MX Platform SW - UI management
1969032
Minor		ENTITY-MIB returns incorrect hardware containment information for SFP Optics
Product-Group=junos		On Junos OS platforms, devices return incorrect information in response to queries for SFP (Small Form-factor Pluggable) inventory and hierarchy levels when data is retrieved using the standard SNMP MIB (Simple Network Management Protocol Management Information Base). As a result, the ENTITY-MIB object 'entPhysicalContainedIn' can report an incorrect parent hardware component for SFP optics

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:27.1R1-EVO junos:25.4R2 junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: Device Configuration Daemon
1970933
Major		Tunnel interface flaps observed on every DNS TTL refresh when FQDN is used as the destination of IP-IP tunnel and the ip-0/0/0 interface is in a routing-instance
Product-Group=junos		On Junos OS SRX platforms, when FQDN (Fully Qualified Domain Name) is used for the destination of IP-IP (Internet Protocol-in-Internet Protocol) tunnel and the ip-0/0/0 interface is in a routing-instance, the ip-0/0/0 interface flaps every time the SRX sends DNS (Domain Name System) query. The issue is caused by a timing condition between rpd (Routing Protocol Daemon) and dcd (Device Control Daemon) during DNS (Domain Name System) re-resolution, resulting in tunnel interface flaps, leading to packet loss.

Resolved In: junos:25.4R2 junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: EVO L2 Control Plane PRs
1968928
Minor		False Routing Software Alarms Triggered by Incorrect Bridge Domain Classification as Multicast VXLAN
Product-Group=junos		On Junos OS and Junos OS Evolved, if Virtual Local Area Networks (VLANs) configured in a Media Access Control Virtual Routing and Forwarding (MAC-VRF) instance with Virtual Extensible Local Area Network (VXLAN) are not included in the associated protocols evpn vni-list, the system incorrectly identifies the corresponding Bridge Domains (BDs) as multicast VXLAN bridge domains. This behavior can result in unnecessary Virtualized Multi-Homing Enhanced (VMENH) next-hop creation and trigger a false routing software alarm

Resolved In: evo:26.2R2-EVO evo:26.4R1-EVO junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: EVPN control plane issues
1963894
Major		Local MAC addresses are not learned on newly added EVPN all-active interfaces
Product-Group=junos		On Junos OS and Junos OS Evolved systems configured with Ethernet VPN (EVPN) Media Access Control Virtual Private Network (MAC-VRF) over Multiprotocol Label Switching (MPLS), when a new all-active interface is added to a service that uses a VLAN-aware instance with interfaces from multiple Ethernet Segments (ESIs) and Egress Link Protection (ELP) enabled, local Media Access Control (MAC) addresses are not learned on the newly added interface. As a result, Layer 2 forwarding for the affected service is impacted and complete loss of Layer 2 forwarding can occur for the affected service. Service can be restored by restarting the affected routing application

Resolved In: evo:24.4R2-S1-J11-EVO evo:24.4R2-S2-J30-EVO evo:24.4R2-S2-J31-EVO evo:24.4R2-S3-J24-EVO evo:26.2R2-EVO evo:26.3R1-EVO evo:26.4R1-EVO junos:26.2R2 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: EX interfaces issues
1976080
Major		EX5200: During repeated pic offline/online events on p2a 8x25g ULM with 25g and 10g optics, one or more of the 25g interfaces are not coming up and remain in down state.
Product-Group=junos		In an EX5200 device with 8x25G uplink module (ULM) inserted, during repeated pic 2 offline/online operation, in some instances random 25G ports which have explicit FEC config, may stay operational down state. The workaround is to reapply the FEC configuration.

Resolved In:
PR NumberSynopsisCategory: EX POE
1969511
Major		False alarms related to PoE Device Manager failures were observed on EX4100
Product-Group=junos		On EX4100-F-24P and EX4100-24P platforms, while running 26.2R1 Junos release, PoE (Power over Ethernet) device manager failed alarms observed for PoE manager 3 to 11 without any triggers. These PoE device managers does not exist physically in these platforms. The actual PoE device managers are 0, 1 and 2. The alarms are cosmetic and there is no operational impact. These alarms can be ignored.

Resolved In: junos:25.4R2 junos:26.2R2 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: Express PFE including evpn, vxlan
1927521
Major		Unexpected FPC reboot in QFX device after inserting and removing a transceiver
Product-Group=junos		On Junos QFX10002-60C/QFX10008/QFX10016 an unexpected FPC reboot with dcpfe core dump is experienced due to a transceiver plug-in plug-out in an Aggregated Ethernet (AE) interface member affecting all traffic on that line card. No manual intervention is required, fpc will automatically reboot and recover

Resolved In: junos:22.2R3-S8 junos:23.2R2-S8 junos:24.2R2-S6
PR NumberSynopsisCategory: SRX4100/SRX4200 platform software
1960371
Major		RG1 failover is not automatically triggered after fan failures on SRX4100/SRX4200 chassis clusters, resulting in traffic degradation
Product-Group=junos		On SRX4100 and SRX4200 chassis clusters, when all chassis fans fail or are removed, the affected node continues forwarding traffic in a degraded thermal state instead of automatically triggering a Redundancy Group 1 (RG1) failover. This result in the traffic loss on the affected node.

Resolved In: junos:25.2R2-S2 junos:25.2R2-S3 junos:25.4R2 junos:26.2R2 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: jdhcpd daemon
1947179
Major		The dhcpd crash triggered by DHCPv6 ALQ peer state inconsistency
Product-Group=junos		On MX104, MX204, MX240, MX301, MX304, MX480, MX960, MX2008, MX2010, MX2020, MX10003, MX10004, MX10008 and MX10016 platforms DHCPv6 (Dynamic Host Configuration Protocol version 6) ALQ (Active Lease Query) peer state inconsistency creates an invalid subscriber entry for a bound IPv6 address, resulting in a jdhcpd (Junos DHCP daemon) crash with recurring core dumps and subscriber traffic impact.

Resolved In: evo:24.2R2-S6-EVO evo:25.2R2-S2-EVO evo:25.4R2-EVO evo:26.2R2-EVO evo:26.3R1-EVO junos:23.4R2-S8-J11 junos:23.4R2-S8-J5 junos:24.2R2-S3-J14 junos:24.2R2-S6 junos:24.4R2-S4-J5 junos:25.2R2-S2 junos:25.4R2 junos:25.4R2-S1 junos:26.2R2 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: Layer2 forwarding on EX/NFX/PTX/QFX
1968275
Minor		[mx10008] ND probes for static MAC-IP EVPN entries are sourced from wrongly built EUI-64 link-local addresses
Product-Group=junos		The EUI-64 link-local address construction in l2alm_irb_local_addr() was missing the mandatory 0xFF, 0xFE byte insertion at positions 3-4 of the interface identifier. After bzero, bytes 3-4 remained 0x00, 0x00, causing NS probes for static MAC-IP entries to use a malformed source address. For example, in problem state, IPv6 link-local address is fe80:: 2293:3900:eb:f44a, derived as follows: IRB MAC: 20:93:39:eb:f4:4a Buggy - before fix - bytes 3-4 left as 00:00 after bzero: [20 | 0x02] 93 39 : 00 00 : eb f4 4a [00 00 is inserted between 2 halves of MAC address] -> fe80:: 2293:3900:eb:f44a [above result is prefixed with fe80:: ] After fix: [20 | 0x02] 93 39 : ff fe : eb f4 4a [FF FE is inserted between 2 halves of MAC address] -> fe80:: 2293:39ff:feeb:f44a [above result is prefixed with fe80:: ]

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:26.4R1-EVO evo:27.1R1-EVO junos:25.4R2 junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: Label Distribution Protocol
1906611
Major		Crash in the rpd process after LDP P2MP LSP Identifier reaches its maximum value and rolls over, due to duplicate identifier allocation
Product-Group=junos		On all Junos OS and Junos OS Evolved versions that support Label Distribution Protocol Point-to-Multipoint Label Switched Paths (LDP P2MP LSPs), the rpd process (routing protocol daemon) crashes when an LSP Identifier reaches its 24-bit maximum value (224 1 = 16, 777, 215) and rolls over to the starting value because a duplicate identifier is incorrectly allocated. This condition occurs only after prolonged tunnel flapping (typically more than 16 million flaps). When the rpd process crashes, routing convergence is briefly disrupted, and services relying on label-switched traffic are impacted until the process automatically restarts.

Resolved In: evo:26.1R1-EVO junos:26.1R1
PR NumberSynopsisCategory: JDHCP is a daemon for EVO platform to handle DHCP protocol
1971042
Minor		On Junos Evolved OS ACX platforms loss of subscriber bindings can disrupt DHCPv6 redundancy synchronization in relay/server HA setups configured with ALQ/BLQ
Product-Group=junos		On Junos Evolved OS ACX platforms configured in High Availability (HA) mode with ALQ/BLQ(Active lease query/Bulk lease query) enabled, a DHCP process crash occur when a customer edge (CE) device sends DHCPv6 IA_NA (Identity Association for Non-Temporary Address) and IA_PD (Identity Association for Prefix Delegation) requests in separate SOLICIT messages, and the requests are processed by different HA peers. This result in loss of the subscriber binding and disrupt DHCPv6 redundancy synchronisation on the relay/server.

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:26.4R1-EVO junos:25.4R2 junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: Used for tracking OVSDB software issues and features
1950782
Critical		Junos OS: A crafted OVSDB message crashes vgd and allows remote code execution (CVE-2026-103994)
Product-Group=junos		A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.

Resolved In: evo:24.4R2-S5-EVO evo:25.4R1-S3-EVO evo:25.4R2-EVO evo:26.2R1-EVO evo:26.2X200-D10-EVO evo:26.3R1-EVO junos:20.2R3-S12 junos:20.3X75-D443 junos:20.3X75-D52-J3 junos:21.2R3-S11 junos:21.2X33 junos:21.2X34 junos:21.4R3-S12 junos:21.4R3-S13 junos:22.2R3-S8 junos:22.3R3-S5 junos:22.3X60-J4 junos:22.4R3-S10 junos:22.4R3-S9 junos:22.4X50 junos:23.2R2-S8 junos:23.4R2-S8 junos:24.2R2-S6 junos:24.4R2-S5 junos:25.2R2-S2 junos:25.4R1-S3 junos:25.4R2 junos:26.2R1 junos:26.3R1
PR NumberSynopsisCategory: Periodic Packet Management Daemon
1931633
Major		PFE crash due to memory corruption when STP is enabled
Product-Group=junos		On all Junos Platforms, a rare memory corruption condition may occur in the Packet Forwarding Engine (PFE) when Spanning Tree Protocol (STP) is enabled and operating in default (distributed) mode. When the issue is triggered, the PFE crashes and a dc-pfe core file is generated. The exact trigger for the memory corruption is currently unknown.

Resolved In: evo:23.4R2-S8-EVO evo:24.2R2-S5-EVO evo:24.2R2-S6-EVO evo:24.4R2-S4-EVO evo:25.2R2-S1-EVO evo:25.2R2-S2-EVO evo:25.4R2-EVO evo:26.2R1-EVO evo:26.2R2-EVO evo:26.3R1-EVO evo:26.4R1-EVO junos:23.4R2-S8 junos:24.2R2-S5 junos:24.4R2-S4 junos:25.2R2-S1 junos:25.2R2-S2 junos:25.4R2 junos:26.2R1 junos:26.2R2 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: QFX EVPN / VxLAN
1969241
Major		Duplicate egress VLAN-translation entry additions in VXLAN configurations cause a forwarding-plane memory leak on QFX5K and EX4K switches
Product-Group=junos		On affected QFX5K and EX4K switches running classic Junos OS, this issue occurs when VXLAN with egress VLAN translation is configured and an egress VLAN-translation entry is repeatedly added while a matching entry already exists. During normal operation, the memory allocated for this operation is released after the existing entry is detected. Due to this issue, the forwarding-plane memory allocated during each duplicate-entry addition is not released, causing memory consumption to accumulate. When the available forwarding-plane memory is exhausted, the FPC restarts while the Routing Engine remains operational. All interfaces on the affected FPC flap, and traffic is interrupted during the restart.

Resolved In: junos:23.2R2-S8 junos:25.4R2 junos:25.4R2-S1 junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: QFX5K JUNOS Interface, MACSec, Optics, SDK, PHY
1934076
Minor		The dcpfe process crash observed during a system reboot or PFE restart when software-based linkscan is configured
Product-Group=junos		On QFX5120-48Y, QFX5120-48T, QFX5120-32C and EX4650 platforms, a system reboot or PFE restart after configuring software-based linkscan causes the dcpfe process to crash. As a result, traffic forwarding on interfaces associated with the affected FPC will be temporarily impacted during the recovery period.

Resolved In: junos:25.2R2-S2 junos:25.4R2 junos:26.2R2 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: KRT Queue issues within RPD
1967283
Minor		The rpd process consumes high CPU when an aggregate route temporarily loses all active contributors with OC-TLV support enabled
Product-Group=junos		On Junos OS and Junos OS Evolved platforms supporting OC-TLV, the rpd process may experience sustained high CPU utilization when OC-TLV support is enabled, and an aggregate route temporarily loses all active contributing routes. A minor CPU hog alarm for the rpd process will be reported. This high CPU utilization subsequently compromises other system processes and protocols, leading to an impact on the traffic.

Resolved In: evo:26.2R2-EVO evo:26.4R1-EVO junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: Issues related route resolution routing infrastructure
1853895
Major		Service route is hidden over BGP LU multipath upon neighbor route withdrawn
Product-Group=junos		On all Junos and Junos Evolved platforms, the following condition is a prerequisite - Service route resolving over BGP LU (Border Gateway Protocol Labeled Unicast) multipath route with multipath resolve policy enabled. The issue occurs when one BGP LU neighbour withdraws its route. This withdrawal causes the top-level service route to temporarily become hidden, and then it reappears after re-resolving over the remaining BGP LU multipath routes. However, after this recovery, the BGP LU resolution changes from multipath to single path.This behavior results in a brief traffic loss during the interval when the service route is hidden and then restored.

Resolved In: evo:24.4R2-EVO evo:25.2R2-EVO evo:25.3R1-EVO junos:22.2R3-S6-J3 junos:22.4X4 junos:24.4R2 junos:25.2R1 junos:25.2R2 junos:25.3R1
PR NumberSynopsisCategory: Resource Reservation Protocol
1969952
Major		RSVP LSP traffic loss during primary path recovery with setup-protection
Product-Group=junos		On Junos and Junos OS Evolved platforms, Resource Reservation Protocol (RSVP) Label-Switched Paths (LSPs) using facility backup(setup-protection) experience a temporary traffic disruption when the primary path recovers and local reversion is enabled. The issue occurs when the LSP is signaled through a non-Junos ingress router and the administrative group constraints of the bypass LSP change. The affected LSP is resignaled during primary path recovery and traffic is disrupted for a few seconds before the LSP recovers automatically.

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:26.4R1-EVO junos:25.4R2 junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: SW PRs for SCBE3 fabric
1965967
Critical		Traffic loss on MX960 after chassis zone power failure
Product-Group=junos		On MX960 platforms, a complete power failure in either chassis zone can cause all fabric planes to become inactive, resulting in complete traffic loss. The issue occurs because remote destination errors are misidentified as local errors by online Flexible PIC Concentrators (FPCs), causing all planes being removed from spray.

Resolved In: junos:21.2X34 junos:21.2X35 junos:21.2X35-J2 junos:23.2R2-S8 junos:24.2R2-S1-J17 junos:24.2R2-S5-J6 junos:25.2R2-S2-J6 junos:25.4R2 junos:25.4R2-S1 junos:25.4R2-S2 junos:26.2R2 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: Issues related to control plane security
1865633
Major		Junos OS: A low-privileged user can escalate their privileges so that they can log in as root (CVE-2026-21916)
Product-Group=junos		A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root, which will lead to a complete compromise of the system. Please refer to https://supportportal.juniper.net/JSA107807 [juniper.net] for more information.

Resolved In: evo:25.2R2-EVO junos:20.2R3-S12 junos:20.2X42 junos:20.3X75-D443 junos:21.2R3-S11 junos:21.2X33 junos:21.4R3-S10-J4 junos:21.4R3-S10-J4-X1 junos:21.4R3-S10-J6 junos:21.4R3-S12 junos:21.4R3-S13 junos:21.4X15 junos:22.4R3-S10 junos:22.4R3-S7-J1 junos:22.4R3-S9 junos:23.2R2-S6 junos:23.4R2-S6 junos:23.4R2-S7 junos:23.4X12 junos:23.4X13 junos:23.4X15 junos:23.4X30 junos:23.4X30-D30 junos:24.2R2-S3 junos:24.2R2-S4 junos:24.2X1 junos:24.2X4 junos:24.2X50 junos:24.4R2-S1 junos:24.4R2-S1-C1 junos:24.4R2-S2 junos:25.2R1-S1 junos:25.2R1-S2 junos:25.2R2
PR NumberSynopsisCategory: Remote Access VPN issues on SRX
1972932
Minor		JSC SAML authentication fails when SRX HTTPS service is configured on a custom port
Product-Group=junos		On SRX platforms, remote-access user authentication for the Juniper Secure Connect (JSC) client using Security Assertion Markup Language (SAML) failed when the Hypertext Transfer Protocol Secure (HTTPS) service under the Hypertext Transfer Protocol Daemon (httpd) was configured on a custom port instead of the standard port 443.

Resolved In: junos:25.4R2 junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: Trio pfe stateless firewall software
1966654
Major		Heap memory leak causing new subscriber login failures on deployments using PPPoE subscriber policer
Product-Group=junos		On Junos OS MX Series platforms, when firewall filters with policer actions are applied to PPPoE subscriber interfaces through dynamic profiles, repeated PPPoE subscriber logout and login events cause memory leak of 16 to 64 bytes during policer event which is not noticeable in low-scale environments. In large BNG (Broadband Network Gateway) deployments, the leaked memory accumulates over time, leading to FPC (Flexible PIC Concentrator) heap memory growth. Once memory utilization exceeds operational thresholds, new PPPoE subscriber login attempts fail.

Resolved In: evo:25.4R2-EVO junos:25.4R2 junos:26.2R2 junos:26.3R1 junos:26.4R1