Alert Type

SRN - Software Release Notification
Low/NotificationSRN
Low/NotificationSoftware Release Notification

Product Affected

ACX PTX QFX running Junos Evolved Software

Alert Description

Alert Description

Junos Software Service Release version 26.2R1-S2-EVO is now available for download from the Junos software download site

Download Junos Software Service Release:

  1. Go to Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

NOTE: Starting on August 30th, 2024, we include PR's severity with each entry. See KB86335 [juniper.net] for the definition of PR's Severity

 

Junos Selective Update (JSU) feasible

Not applicable

Call to Action

For review

Solution

Junos Software service Release version 26.2R1-S2-EVO is now available.

26.2R1-S2-EVO - List of Fixed issues

PR NumberSynopsisCategory: Fabric for LC1300 and SIB3
1964102
Major		Major alarms for fabric link faults that result in reduced fabric capacity are introduced on PTX10004 and PTX10008 platforms
Product-Group=evo
Severity=Major		On Junos OS Evolved PTX10004 and PTX10008 platforms with LC1301 line cards and SF5 fabric, fabric link faults need to be reported as major alarms. Link faults can occur during system operation and result in reduced fabric capacity with partial impact. This enhancement introduces the new alarm "One or more PFE pairs operating with less than acceptable fabric capacity" to indicate reduced fabric capacity conditions.
PR NumberSynopsisCategory: "agentd" software daemon
1954177
Major		Junos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabled (CVE-2026-101965)
Product-Group=evo
Severity=Major		An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1954178
Critical		Junos OS Evolved: An attacker causes na-grpcd to crash when gRPC telemetry is enabled (CVE-2026-102012)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS and Junos EVO allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1954180
Critical		Junos OS and Junos OS Evolved: An attacker causes na-grpcd to crash when the InitialSync service is used (CVE-2026-102013)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the na-grpcd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker with access to the chassis-internal network to cause a denial of service via a network message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Bi Directional Forwarding Detection (BFD)
1958106
Critical		Junos OS and Junos OS Evolved: An attacker causes a bfdd denial of service when BFD is enabled (CVE-2026-102058)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Border Gateway Protocol
1953061
Critical		Junos OS and Junos OS Evolved: In a non-4byte-AS scenario a specific BGP update causes an rpd crash (CVE-2026-101976)
Product-Group=evo
Severity=Critical		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS). Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953065
Critical		Junos OS and Junos OS Evolved: In a scenario with VPN-flowspec and BMP monitoring a specific BGP update causes an rpd crash (CVE-2026-101949)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953085
Critical		Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabled (CVE-2026-101952)
Product-Group=evo
Severity=Critical		An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953394
Critical		Junos OS and Junos OS Evolved: A remote BGP peer causes an rpd crash when long-lived graceful restart (LLGR) is used (CVE-2026-101957)
Product-Group=evo
Severity=Critical		An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953397
Critical		Junos OS and Junos OS Evolved: A malformed LSP-ping causes an rpd crash (CVE-2026-101959)
Product-Group=evo
Severity=Critical		A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953950
Critical		Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when an ECMP qualifier is used in an import policy (CVE-2026-101961)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953962
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP ISO-VPN egress protection is enabled (CVE-2026-101940)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954000
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd crash and denial of service when EVPN is configured (CVE-2026-101943)
Product-Group=evo
Severity=Critical		An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a crafted BGP EVPN update message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954487
Major		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when labeled-unicast aggregate-label is configured (CVE-2026-101984)
Product-Group=evo
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954857
Critical		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised (CVE-2026-101990)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash or, on Junos OS, remote code-execution via sending a flow-spec update selected for re-advertisement. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956236
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is used (CVE-2026-102026)
Product-Group=evo
Severity=Critical		An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a routing-daemon crash via a BGP route update when RIB sharding is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: BGP BMP Software
1952211
Critical		Junos OS and Junos OS Evolved: Malformed BMP messages cause rpd CPU exhaustion or a crash (CVE-2026-102181)
Product-Group=evo
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in BGP Monitoring Protocol (BMP) message-processing of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause routing protocol daemon (rpd) CPU exhaustion or a crash via malformed BMP messages. Please refer to https://supportportal.juniper.net/JSAxx for more information.
1952604
Critical		Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in denial of service (CVE-2026-33789)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952739
Critical		Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled (CVE-2026-33796)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: BBE Remote Access Server
1954232
Critical		Junos OS: An attacker causes authd to crash when subscriber RADIUS authentication is used (CVE-2026-102014)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberSynopsisCategory: Express BX PFE L3 Features
1964489
Major		Traffic impact is observed due to rapid interface flapping on PTX12008 routers or devices equipped with JNP10K-LC1301 FPC or JNP10008-SF5 SIB modules
Product-Group=evo
Severity=Major		On Junos OS Evolved PTX12008 platform or devices equipped with JNP10K-LC1301 FPC (Flexible PIC Concentrator) or JNP10008-SF5 SIB (Switch Interface Board) cards, a rapid (sub-second) interface flap triggers a timing issue that causes the evo-cda-bx process to hog CPU resources. These periods of high CPU utilization affect other processes and protocols, ultimately impacting traffic on the device.
PR NumberSynopsisCategory: QFX Access Control related
1955815
Major		Junos OS: An ICCP peer causes dot1xd to crash when dot1x synchronization is enabled (CVE-2026-102069)
Product-Group=evo
Severity=Major		A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is triggered when dot1x synchronization is enabled for the required Fusion satellite topology. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
1956093
Critical		Junos OS and Junos OS Evolved: An attacker causes root code execution when 802.1X authentication is used (CVE-2026-102015)
Product-Group=evo
Severity=Critical		A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: EVO cfmd RE related PRs
1957845
Critical		Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remote code execution and denial of service when enhanced CFM is enabled (CVE-2026-102055)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent to a configured down-MEP with enhanced CFM mode enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957850
Critical		Junos OS and Junos OS Evolved: An attacker causes denial of service and information disclosure when Ethernet CFM is enabled (CVE-2026-102056)
Product-Group=evo
Severity=Critical		An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Firewall related development
1956227
Critical		Junos OS Evolved: An attacker causes denial of service via SNMP when firewall counters are used (CVE-2026-102023)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberSynopsisCategory: EVO linux defects & enhancement requests
1892248
Minor		Junos OS Evolved: A Linux kernel vulnerability in the HID driver allows an attacker to read information from the HID Report buffer (CVE-2024-50302)
Product-Group=evo
Severity=Minor		A Use of Uninitialized Resource in the Linux kernel driver for Human Interface Devices (HID) in Junos OS Evolved allows a local low-privileged attacker to use a malicious input device to read information from the report buffer. This could be used to leak kernel memory, enabling the exploitation of additional vulnerabilities. Please refer to https://supportportal.juniper.net/JSA106000 [juniper.net] for more information.
1960724
Major		On Linux based platforms, kernel panic and crash observed during firmware download due to a device removal race condition
Product-Group=evo
Severity=Major		On Linux based Junos and Junos-Evo platforms, system might experience a kernel panic and unexpected restart if a firmware download is in progress when the associated device is removed, reset, or undergoes a line-card or PCIe card flap. This is a low-probability, timing-dependent issue that requires the firmware download and device-removal operations has to happen simultaneously.
PR NumberSynopsisCategory: Issues related to NTP issues on evo
1923757
Major		Nagios server not able to connect to ACX7024X
Product-Group=evo
Severity=Major		On EVO ACX platforms with VRF/loopback/vrrp when ntpd replies to client requests the NTP server responses uses incorrect source addresses instead of the destination address of the received packet, causing NTP client queries to fail or receive responses from unexpected source addresses.
PR NumberSynopsisCategory: EVO Socket replication
1955807
Critical		Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP key-chain authentication is used (CVE-2026-102068)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP SYN packet when key-chain authentication is used for BGP or LDP. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberSynopsisCategory: AAA, auditd issues
1956332
Critical		Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled (CVE-2026-102031)
Product-Group=evo
Severity=Critical		An OS Command Injection vulnerability in tacacs of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
PR NumberSynopsisCategory: eventd, syslog infra issues
1953680
Critical		Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventd (CVE-2026-101934)
Product-Group=evo
Severity=Critical		An Out-of-bounds Write vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved allows a local attacker to cause a Denial of Service (DoS) via sending a crafted packet to the eventd relay service. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: EVPN control plane issues
1952196
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP EVPN RIB telemetry is used (CVE-2026-102179)
Product-Group=evo
Severity=Critical		An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Successful exploitation can crash rpd and interrupt routing protocols until the daemon restarts and reconverges. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1952495
Critical		Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when EVPN multihoming preference-based DF election is used (CVE-2026-102185)
Product-Group=evo
Severity=Critical		A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953998
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route signaling is used (CVE-2026-101942)
Product-Group=evo
Severity=Critical		An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954001
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing protocol daemon denial of service when EVPN is used (CVE-2026-101944)
Product-Group=evo
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of service via specially crafted EVPN route updates from an accepted EVPN BGP peer. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954002
Critical		Junos OS and Junos OS Evolved: An attacker causes routing daemon denial of service when EVPN BGP is enabled (CVE-2026-101945)
Product-Group=evo
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954029
Major		Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used (CVE-2026-101963)
Product-Group=evo
Severity=Major		An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954478
Critical		Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used (CVE-2026-101982)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Control plane EVPN multicast
1953997
Major		Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used (CVE-2026-101962)
Product-Group=evo
Severity=Major		An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Internet Group Management Protocol
1958122
Critical		Junos OS and Junos OS Evolved: MX Series, ACX Series: An attacker causes a routing daemon crash when multicast lawful intercept is used (CVE-2026-102060)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: ISIS routing protocol
1954540
Critical		Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is used (CVE-2026-101987)
Product-Group=evo
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service by sending a specific IS-IS SRv6 packet when SRv6 and Flexible Algorithm are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Category for JET(JUNOS Extension Toolkit) related issues
1963718
Major		Junos OS: An authenticated attacker causes a denial of service when the gRPC extension-service is enabled (CVE-2026-102072)
Product-Group=evo
Severity=Major		An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to cause a denial of service via a compressed gRPC request. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberSynopsisCategory: SRX Firewall Authentication
1953636
Critical		Junos OS and Junos OS Evolved: SRX Series: An attacker causes remote code execution when SRX chassis-cluster is enabled (CVE-2026-33798)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
1953761
Critical		Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is enabled (CVE-2026-101936)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
1953762
Critical		Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is used (CVE-2026-101937)
Product-Group=evo
Severity=Critical		A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberSynopsisCategory: IPSEC/IKE VPN
1951651
Critical		Junos OS: SRX Series: An authenticated remote-access VPN client causes iked denial of service or root-level code execution when JIMS identity publishing is enabled (CVE-2026-102174)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS identity-publishing path. Please refer to https://supportportal.juniper.net/JSA112186 [juniper.net] for more information.
PR NumberSynopsisCategory: Layer 2 Control Module
1957359
Critical		Junos OS and Junos OS Evolved: An attacker causes l2cpd denial of service when MVRP is used (CVE-2026-102047)
Product-Group=evo
Severity=Critical		An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2 attacker to cause a denial of service in associated Layer 2 control protocols via a crafted MVRP Ethernet frame sent to an MVRP-enabled interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957363
Critical		Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code execution when Unified Access Policy is enabled (CVE-2026-102049)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access Policy enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957368
Critical		Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of service when LLDP is enabled (CVE-2026-102050)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated triggering may disrupt LLDP and other Layer 2 control protocols across the device. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957373
Critical		Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion when LLDP fast receive processing is enabled (CVE-2026-102051)
Product-Group=evo
Severity=Critical		An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast receive processing is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Layer2 forwarding on EX/NFX/PTX/QFX
1956577
Critical		Junos OS and Junos OS Evolved: Unintended L2ALD memory allocation causes a denial of service when static MAC IP configurations are present (CVE-2026-102032)
Product-Group=evo
Severity=Critical		A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via crafted packets when the static MAC-IP feature is in use. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956583
Critical		Junos OS and Junos OS Evolved: An attacker causes a denial of service when MC-LAG IRB MAC synchronization is enabled (CVE-2026-102035)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP peer message when MC-LAG IRB MAC synchronization is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956599
Critical		Junos OS and Junos OS Evolved: An EVPN default-gateway route burst causes l2ald denial of service (CVE-2026-102036)
Product-Group=evo
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of service via EVPN Type-2 MAC/IP routes. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1957710
Critical		Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configured (CVE-2026-102054)
Product-Group=evo
Severity=Critical		An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local VTEP. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: lacp protocol
1956919
Critical		Junos OS Evolved: An crafted LACP frame causes lacpd to crash when LACP is enabled (CVE-2026-102045)
Product-Group=evo
Severity=Critical		An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port. Refer to https://supportportal.juniper.net/JSA112250 [juniper.net]
PR NumberSynopsisCategory: Label Distribution Protocol
1954119
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled (CVE-2026-101999)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session carrying an IPv6 Prefix FEC in a specific Label message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954120
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled (CVE-2026-102000)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP control traffic. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954127
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP link protection is enabled (CVE-2026-102011)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session when two misconfigured neighbors (or one neighbor duplicated by an L2 loop) advertise the same transport address on a link-protected interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: mc-ae interface
1954885
Major		Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes L2ALD heap disclosure or crash (CVE-2026-101994)
Product-Group=evo
Severity=Major		An Improper Handling of Length Parameter Inconsistency vulnerability in the L2ALD daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control or impersonate a configured MC-LAG ICCP peer to disclose process heap memory or cause a denial of service via a malformed ICCP message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954888
Major		Junos OS and Junos OS Evolved: Malformed ICCP packets cause L2ALD memory disclosure and disruption (CVE-2026-101995)
Product-Group=evo
Severity=Major		An Improper Validation of Specified Quantity in Input vulnerability in the L2ALD of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker with access to an ICCP peer session to cause memory disclosure and disruption of the L2ALD daemon via malformed ICCP packets. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956578
Critical		Junos OS and Junos OS Evolved: An attacker causes denial of service when MC-LAG MAC synchronization is enabled (CVE-2026-102033)
Product-Group=evo
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP MC-LAG message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956580
Critical		Junos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LAG ICCP MAC synchronization is enabled (CVE-2026-102034)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured ICCP peer to cause a denial of service via a malformed MC-LAG message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Multiprotocol Label Switching
1956673
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing control-plane denial of service when BGP-LS traffic engineering is enabled (CVE-2026-102044)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Multicast for L3VPNs
1953081
Critical		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash if a malformed MCAST-TREE NLRI is received and readvertised (CVE-2026-101951)
Product-Group=evo
Severity=Critical		An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent configured BGP peer to cause a denial of service by sending a specifically malformed BGP MCAST-TREE update and this NLRI is then attempted to be readvertised. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1955224
Major		Junos OS and Junos OS Evolved: An attacker causes an rpd crash when inter-AS MVPN ingress replication is used (CVE-2026-102064)
Product-Group=evo
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956148
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing outage when BGP MVPN signaling is enabled (CVE-2026-102016)
Product-Group=evo
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP MVPN peer to cause a denial of service via a BGP MVPN signaling update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956262
Critical		Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used (CVE-2026-102030)
Product-Group=evo
Severity=Critical		An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an interregion segmented VRF with 'protocols mvpn inter-region-template' is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: OSPF routing protocol
1951247
Critical		Junos OS and Junos OS Evolved: Malformed OSPF packets causes routing disruption when OSPF is enabled (CVE-2026-101972)
Product-Group=evo
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1951273
Critical		Junos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclosure or service disruption when link-local TE processing is used (CVE-2026-101974)
Product-Group=evo
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1951277
Critical		Junos OS and Junos OS Evolved: Improper OSPF LSA validation causes an rpd crash when prefix-SID best-route installation is used (CVE-2026-101975)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1958211
Critical		Junos OS and Junos OS Evolved: An attacker causes routing protocol daemon crash when OSPFv3 is enabled (CVE-2026-101971)
Product-Group=evo
Severity=Critical		An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service and heap memory corruption via OSPFv3 messages on an enabled broadcast interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: MPLS Point-to-Multipoint TE
1954123
Major		Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP message (CVE-2026-101964)
Product-Group=evo
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted Label Mapping message received over an established LDP session.Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954449
Major		Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when LDP is enabled (CVE-2026-101981)
Product-Group=evo
Severity=Major		A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954545
Major		Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker causes an rpd crash when LDP is enabled (CVE-2026-101988)
Product-Group=evo
Severity=Major		A NULL Pointer Dereference vulnerability in the routing protcol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954547
Major		Junos OS and Junos OS Evolved: An crafted LDP message causes an rpd crash when LDP is enabled (CVE-2026-101989)
Product-Group=evo
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash via a crafted LDP message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Phone-Home-Client Infrastructure
1954221
Critical		Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used (CVE-2026-101967)
Product-Group=evo
Severity=Critical		An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response if the management-instance configuration enabled. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1954222
Critical		Junos OS Evolved: PTX Series: An attacker controlled gRPC response causes root-level compromise when zero-touch provisioning is used (CVE-2026-101978)
Product-Group=evo
Severity=Critical		An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response. Please refer to https://supportportal.juniper.net/JSA112250 [juniper.net] for more information.
1958116
Critical		Junos OS and Junos OS Evolved: EX Series, SRX Series, QFX Series: A rogue DHCP server causes root-level command execution when the phone-home client processes specific information (CVE-2026-102059)
Product-Group=evo
Severity=Critical		An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1958129
Major		Junos OS and Junos OS Evolved: An attacker causes root code execution when SZTP DHCP provisioning is used (CVE-2026-102061)
Product-Group=evo
Severity=Major		A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Protocol Independant Multicast
1956154
Critical		Junos OS and Junos OS Evolved: An attacker causes routing-plane denial of service when Auto-RP mapping is enabled (CVE-2026-102017)
Product-Group=evo
Severity=Critical		An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of service via Auto-RP mapping announcements received when Auto-RP mapping is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956156
Critical		Junos OS and Junos OS Evolved: Malformed PIM Bidir DF-Election messages cause routing service disruption when bidirectional PIM is enabled (CVE-2026-102018)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed PIM Bidir message. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net]
1958191
Critical		Junos OS and Junos OS Evolved: An unauthenticated attacker causes rpd denial of service when IPv6 PIM is enabled (CVE-2026-101969)
Product-Group=evo
Severity=Critical		An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1958197
Critical		Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used (CVE-2026-101970)
Product-Group=evo
Severity=Critical		A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Issues related to PKI daemon
1951251
Critical		Junos OS: Malformed packet causes pkid denial of service when certificate re-enrollment is used (CVE-2026-101973)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during enrollment or automatic certificate re-enrollment. Please refer to https://supportportal.juniper.net/JSA112188 [juniper.net] for more information.
PR NumberSynopsisCategory: Routing Information Protocol
1956181
Critical		Junos OS and Junos OS Evolved: Malformed RIPv2 messages cause routing service disruption when RIP is enabled (CVE-2026-102019)
Product-Group=evo
Severity=Critical		An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed RIPv2 message. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net]
PR NumberSynopsisCategory: rosen-6 and rosen-7 mvpn bugs
1958185
Major		Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd heap memory disclosure when Rosen-MVPN data-MDT is enabled (CVE-2026-101968)
Product-Group=evo
Severity=Major		An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory disclosure and multicast join-state injection via a malformed Rosen-MVPN message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Issues related to dynamic-tunnels routing infrastructure
1955227
Major		Junos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dynamic tunnels are enabled (CVE-2026-102065)
Product-Group=evo
Severity=Major		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause an rpd crash via a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: RPD Next-hop issues including indirect, CNH, and MCNH
1955220
Minor		Junos OS: MX Series: An unauthenticated network attacker causes an rpd crash when HFRR link protection is used (CVE-2026-102063)
Product-Group=evo
Severity=Minor		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF. Please refer to https://supportportal.juniper.net/JSA112196 [juniper.net] for more information.
PR NumberSynopsisCategory: RPD policy options
1953064
Critical		Junos OS and Junos OS Evolved: A specific BGP FlowSpec update causes an rpd crash when BGP FlowSpec import policy is used (CVE-2026-101948)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a denial of service via a specific BGP FlowSpec update received by an affected BGP session. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1953954
Critical		Junos OS and Junos OS Evolved: A routing-policy table reference causes routing-daemon denial of service when source-based forwarding is used (CVE-2026-101939)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table ` is configured to reference a routing table that does not exist. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Issues related route resolution routing infrastructure
1956239
Critical		Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath next-hops are processed (CVE-2026-102027)
Product-Group=evo
Severity=Critical		An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: RPD route tables, resolver, routing instances, static routes
1956233
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP extended-nexthop-tunnel is used (CVE-2026-102024)
Product-Group=evo
Severity=Critical		An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956235
Critical		Junos OS and Junos OS Evolved: A BGP route-processing error causes rpd crash when extended next-hop tunneling and SRv6 service processing are used (CVE-2026-102025)
Product-Group=evo
Severity=Critical		A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: multicast source distribution protocol
1956260
Critical		Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when an MSDP or PIM policy uses AS-path expansion (CVE-2026-102029)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Resource Reservation Protocol
1955230
Critical		Junos OS and Junos OS Evolved: Malformed RSVP packet causes a rpd crash when RSVP is enabled (CVE-2026-102066)
Product-Group=evo
Severity=Critical		A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1955500
Major		Junos OS and Junos OS Evolved: A specific RSVP packet causes an rpd crash when L2 LSP support is used (CVE-2026-102067)
Product-Group=evo
Severity=Major		An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a crafted RSVP packet when L2 LSP support is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information
1956204
Critical		Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MPLS-TE error processing is enabled (CVE-2026-102021)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956651
Critical		Junos OS and Junos OS Evolved: An attacker causes routing-process denial of service when GMPLS EVPL dynamic transport is used (CVE-2026-102039)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a malformed RSVP Path message received on an EVPL LMP control channel. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956653
Critical		Junos OS and Junos OS Evolved: An attacker crashes the routing daemon when co-routed bidirectional RSVP LSPs are used (CVE-2026-102040)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the routing daemon and cause a denial of service via an RSVP Path message. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956659
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when RSVP is enabled (CVE-2026-102041)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a denial of service via malformed RSVP signaling when RSVP is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956663
Critical		Junos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP associated-bidirectional LSP is enabled (CVE-2026-102042)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE associated-bidirectional LSP signaling. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1962883
Major		Junos OS and Junos OS Evolved: Specific RSVP packet causes an rpd crash when associated bidirectional LSP is enabled (CVE-2026-102071)
Product-Group=evo
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: SNMP Infrastructure (snmpd, mib2d)
1954250
Critical		Junos OS and Junos OS Evolved: A network attacker causes root-level code execution or denial of service when SNMP and AAA are enabled (CVE-2026-101979)
Product-Group=evo
Severity=Critical		A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Segment routing traffic Engineering
1956203
Critical		Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when BGP-LS TED export is enabled (CVE-2026-102020)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via BGP-LS routing updates. Refer to https://supportportal.juniper.net/JSA112187 [juniper.net]
1956205
Critical		Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when BGP-LS traffic-engineering is enabled (CVE-2026-102022)
Product-Group=evo
Severity=Critical		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS peer to cause an rpd crash via a crafted BGP-LS Link NLRI advertisements. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: N/A:sw-srx4xx-platform:
1969442
Critical		SRX400/SRX440 upgrade fails and enters a boot loop when using an empty USB drive to upgrade
Product-Group=evo
Severity=Critical		On SRX400 and SRX440 platforms, when the upgrade is performed using an empty USB drive along with an incomplete/incorrect/inaccessible PXE (Preboot Execution Environment) configuration, the upgrade fails, and the device enters a reboot loop.
PR NumberSynopsisCategory: UI Infrastructure - mgd, DAX API, DDL/ODL
1951668
Critical		Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is used (CVE-2026-102175)
Product-Group=evo
Severity=Critical		A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Issues related to Logging/Tracing, errmsg, eventd infrastruc
1953674
Critical		Junos OS and Junos OS Evolved: An unprivileged local attacker causes denial of service or privilege escalation (CVE-2026-101927)
Product-Group=evo
Severity=Critical		A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service (DoS) or achieve privilege escalation to root via crafted IPC event messages. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
PR NumberSynopsisCategory: Virtual Private LAN Services
1954879
Major		Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when automatic VPLS site ID is used (CVE-2026-101992)
Product-Group=evo
Severity=Major		An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP peer to cause an rpd crash via a BGP VPLS signaling update. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1954880
Major		Junos OS and Junos OS Evolved: An eBGP peer causes an rpd crash when VPLS automatic site-ID collision resolution is used (CVE-2026-101993)
Product-Group=evo
Severity=Major		A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a denial of service via a VPLS signaling update when automatic site-ID negotiation is enabled. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.
1956248
Critical		Junos OS and Junos OS Evolved: An attacker causes an rpd crash when VPLS auto-discovery is used (CVE-2026-102028)
Product-Group=evo
Severity=Critical		A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured. Please refer to https://supportportal.juniper.net/JSA112187 [juniper.net] for more information.

 

 

26.2R1-S2-EVO - List of Known issues

PR NumberSynopsisCategory: PTX10003 Platform related issues
1972066
Major		SIB recovery failure results in prolonged traffic blackholing on PTX10003 platforms
Product-Group=evo		On Junos OS Evolved PTX10003 platforms, a rare fabric fault on a SIB (Switch Interface Board) causes the SIB to stop forwarding traffic. A failure to recover the affected SIB results in repeated traffic blackholing and prolonged traffic disruption.

Resolved In: evo:22.3X50-EVO evo:22.3X50-J5-EVO evo:22.3X80-D49-EVO evo:24.4R2-S3-J3-EVO evo:25.4R2-EVO evo:26.2X200-EVO evo:26.4R1-EVO junos:25.4R2
PR NumberSynopsisCategory: EVO L3 routing for BCM XGS Platforms
1964477
Major		On all Junos Evolved QFX platforms IPv6 static /56 routes stop forwarding traffic after route reprocessing triggered by topology changes
Product-Group=evo		On all Junos Evolved QFX platforms, IPv6 traffic destined to networks reachable through affected IPv6 static /56 routes stops forwarding after topology changes such as reboots or link flaps cause route reprocessing. This results in loss of IPv6 connectivity for the affected prefixes.

Resolved In: evo:25.2X100-D22-EVO evo:25.2X100-D30-EVO evo:25.2X100-EVO evo:26.2R2-EVO evo:26.4R1-EVO
PR NumberSynopsisCategory: Express BX PFE L3 Features
1878647
Minor		Physical interface creation failure was ignored resulting in system crash or traffic blackhole
Product-Group=evo		On Junos OS Evolved PTX Series routers, during physical interface deactivate/activate operations, failure to recreate a physical Interface Device (IFD) resulted in an inconsistent interface state. This issue caused a system crash leading to service disruption or traffic blackhole.

Resolved In: evo:24.4R2-S3-C1-EVO evo:24.4R2-S3-J1-EVO evo:24.4R2-S3-J15-EVO evo:24.4R2-S4-EVO evo:24.4R2-S5-EVO evo:25.2R2-EVO evo:25.3R1-EVO evo:25.4R1-EVO
PR NumberSynopsisCategory: Firewall Filter
1960632
Minor		Firewall logs always display ICMP type 0
Product-Group=evo		On all MX platforms running MPC10E, MPC11E, MX10K-LC4802, and MX10K-LC9600 line cards, as well as Junos OS Evolved platforms, when a firewall filter term with the log action matches Internet Control Message Protocol (ICMP) traffic, firewall logs display ICMP packets as type 0, preventing administrators from identifying the actual ICMP type in logged traffic.

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:26.4R1-EVO junos:24.4R2-S3-J22 junos:25.2R2-S1-J11 junos:25.4R2 junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: DNX L2 related features
1967752
Minor		Traffic flooding will occur when LAGs span both AE interface pools on Junos OS Evolved Platforms
Product-Group=evo		On Junos OS Evolved platforms, When Link Aggregation Groups (LAGs) were configured across different AE interface pools (ae0-ae1999 and ae2000+)sharing the same hardware trunk identifier. Under specific conditions, a Media Access Control (MAC) flush event on one LAG could inadvertently remove MAC entries for another LAG from hardware while retaining them in software, leading to traffic flooding and forwarding disruption.

Resolved In: evo:24.2X2-EVO evo:25.4R2-EVO evo:26.2R2-EVO evo:26.3R1-EVO evo:26.4R1-EVO junos:25.4R2 junos:26.2R2 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: ACX LAG infrastructure
1962282
Major		PTP synchronization failure after reboot when PTP is configured over an AE interface
Product-Group=evo		On Junos OS Evolved ACX platforms with PTP (Precision Time Protocol) G.8275.1 profile configured over a LAG (Link Aggregation Group) interface, PTP will remain in the Acquiring state following a device reboot or RE (Routing Engine) switchover. This occurs because, after the reboot, an unexpected value is passed during PTP hardware programming. As a result, the hardware programming operation fails, preventing PTP from completing synchronization and transitioning out of the Acquiring state, resulting in PTP timing inaccuracies and impacting time-sensitive services.

Resolved In: evo:24.4R2-J19-EVO evo:25.4R2-EVO evo:26.2R2-EVO evo:26.3R1-EVO evo:26.4R1-EVO
PR NumberSynopsisCategory: sflow issues on ACX platforms
1957160
Minor		Multiple link flaps observed on all ACX7K platforms
Product-Group=evo		On all ACX7K platforms, an internal ASIC interrupt was triggered in two different scenarios, in some cases the issue is seen without any change in the configuration and in some other cases the issue is seen when an egress sflow (sampled Flow) and egress mirror was enabled/attached to the same interface and committed. The triggered interrupt causes multiple interface flaps and temporary suspension of the ASIC programming resulting in transient disruption of forwarding operations and packet loss.

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:26.4R1-EVO
PR NumberSynopsisCategory: Control Plane for Node Virtualization
1958675
Minor		MPC11 line card in SUBLC configuration within a GNF remain stuck in 'Present' state during online or offline operations
Product-Group=evo		On Junos MX2010 and MX2020 platforms with MPC11 line cards in a Sub Line Card (SUBLC) configuration within a Guest Network Function (GNF), SUBLC become stuck in the "Present" state. This is triggered after 10 days of system uptime when periodic filesystem cleaning deletes the critical /tmp/clmd directory, and any direct or indirect attempts to bring SLCs offline/online will trigger the issue. This results in a localized line-card outage and traffic impact.

Resolved In: evo:25.4R2-EVO evo:26.3R1-EVO junos:24.2R2-S4-J3 junos:24.2R2-S6 junos:24.2R2-S7 junos:25.4R2 junos:26.3R1
PR NumberSynopsisCategory: EVO linux defects & enhancement requests
1867244
Major		All engineering-supported releases of Junos OS and Junos OS Evolved on all platforms are not vulnerable CVE-2025-0167 CVE-2025-0665 CVE-2025-0725
Product-Group=evo		Upon engineering evaluation of these three CVE IDs, Juniper Networks has determined that all engineering-supported releases of Junos OS and Junos OS Evolved on all platforms are not vulnerable CVE-2025-0167 CVE-2025-0665 CVE-2025-0725. While there is no risk associated with these 3 CVE IDs, customers are advised to follow current IETF Security Best Current Practices, including but not limited to restricting access to authorized users, devices, and networks.

Resolved In: evo:25.4R1-EVO evo:25.4R2-EVO
PR NumberSynopsisCategory: ACX7332 & ACX7348 Platform Software
1969900
Major		The Routing Engine reboots unexpectedly and reports "MSMI error/hw misc"
Product-Group=evo		On affected ACX7300 platforms, a hardware-related condition causes the Routing Engine to stop responding and reboot unexpectedly. When the issue occurs, the reboot reason is reported as "MSMI error/hw misc". Routing protocols and network services are interrupted while the Routing Engine restarts and recovers.

Resolved In: evo:24.2X2-EVO evo:25.4R2-EVO evo:25.4X50-EVO evo:26.2R2-EVO evo:26.3R1-EVO evo:26.4R1-EVO junos:25.4R2 junos:26.2R2 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: Platform infra to support jvision
1964847
Major		The sensord generates a crash file and triggers an MPC10 line card restart on MX platforms
Product-Group=evo		On MX platforms with MPC10 line cards, the sensord daemon generates a crash file due to a race condition associated with telemetry subscriptions to sensors such as cmerror, fabric, transceiver, and optics. The issue can occur with explicit telemetry sensor subscriptions or with subscriptions that are active by default and results in an MPC10 line card restart and service impact on the affected line card.

Resolved In: evo:23.2R2-S8-EVO evo:25.4R2-EVO evo:26.2R2-EVO evo:26.4R1-EVO junos:23.2R2-S3-J25 junos:23.4R2-S8-J14 junos:24.2R2-S5-J6 junos:25.2R2-S2-J6 junos:25.4R2 junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: N/A:sw-octomore-qsfp-intf:
1946222
Major		Excessive xcvr config_mismatch DEBUG messages were generated in picd during periodic monitoring
Product-Group=evo		On Junos EVO PTX Series platforms (PTX12008, PTX10001-36MR, and PTX10003-160C), when a transceiver (xcvr) configuration mismatch alarm was present, the picd periodic transceiver monitoring process generated repetitive DEBUG log messages. The issue was observed in environments containing transceivers reporting configuration mismatch alarms. During periodic monitoring, the same mismatch and alarm conditions were repeatedly logged, resulting in excessive growth of picd logs.

Resolved In: evo:24.4R2-S4-EVO evo:24.4R2-S5-EVO evo:25.4R2-EVO evo:26.2R2-EVO evo:26.3R1-EVO evo:26.4R1-EVO
PR NumberSynopsisCategory: Transport daemon for Packet Optical applications
1979263
Minor		Optical performance monitoring becomes unavailable on PTX platforms with high scale of coherent-ZR interfaces
Product-Group=evo		On Junos Evolved PTX platforms, systems with approximately 240 or more interfaces configured on ports using coherent-ZR optics (such as 100ZR and 400ZR transceivers) experience a loss of optical performance monitoring functionality. As a result, optical performance monitoring data, alarms, and statistics are no longer available through management interfaces.

Resolved In: evo:24.4R2-S5-C1-EVO evo:25.4R2-EVO evo:26.2R2-EVO evo:26.2X200-D20-EVO evo:26.2X200-EVO evo:26.4R1-EVO evo:27.1R1-EVO
PR NumberSynopsisCategory: N/A:sw-rfc2544-evo:
1970669
Minor		ACX configuring RFC2544 unsupported commands ovlan-id and/or ivlan-id causes configd process to crash
Product-Group=evo		On ACX Series Platforms committing an RFC2544 service that includes unsupported VLAN-related RFC2544 attributes ovlan-id or ivlan-id. When RFC2544 service monitoring was configured together with Circuit Cross Connect (CCC), VLAN-CCC interfaces, or Layer 2 Circuit (L2Circuit) services. After the triggering configuration is processed, configd repeatedly restarts, generates core files. ACX Series Platforms running Junos Evo software are affected. Impact low.

Resolved In: evo:25.4R2-EVO evo:26.2R2-EVO evo:26.4R1-EVO
PR NumberSynopsisCategory: PTX10K Line Card specific interface PRs
1970944
Major		Incorrect optics module temperature readings can cause the optics to shut down
Product-Group=evo		On MX platforms with MPC11, LC9600, LC4800, LC4802 Linecards, MX304 & MX301 and all Junos OS Evolved platforms, QSFP28 optics modules intermittently reports report false high temperature values leading to optics shutdown.

Resolved In: evo:22.3X80-D49-EVO evo:23.2R2-S8-EVO evo:24.2R2-S3-J15-EVO evo:24.2R2-S4-J6-EVO evo:24.4R2-S5-C1-EVO evo:25.4R2-EVO evo:26.2X200-EVO evo:26.3R1-EVO evo:26.4R1-EVO evo:27.1R1-EVO junos:24.2R2-S5-J3 junos:25.4R2 junos:26.2R2 junos:26.3R1 junos:26.4R1
PR NumberSynopsisCategory: PTX10K specific platform PRs
1771483
Major		EVO: RPC "get-power-usage-information" for cli "show chassis power" shows error wtih ODL response
Product-Group=evo		RPC "get-power-usage-information" for cli "show chassis power" shows error wtih ODL response

Resolved In:
1953725
Minor		Incorrect allocated power values are returned via telemetry
Product-Group=evo		Due to missing capdb change, telemetry incorrectly reports the allocated power values for RCB and fan tray.

Resolved In: evo:25.4R2-EVO evo:26.3R1-EVO junos:26.3R1
1962272
Minor		PTX10K power supply input failure SNMP traps do not include the affected input feed information
Product-Group=evo		On Junos OS Evolved PTX10K platforms with an AC3H power supply module (PSM) installed, when an input feed failure occurs, the generated Simple Network Management Protocol (SNMP) jnxPowerSupplyInputFailure trap does not include information identifying the affected input feed. This limits the ability of SNMP-based monitoring applications to accurately identify the failed power input feed from the trap notification alone. This issue does not affect production traffic forwarding or cause service interruption.

Resolved In: evo:25.4R2-EVO evo:26.4R1-EVO junos:25.4R2 junos:26.4R1
PR NumberSynopsisCategory: ZT/YTpfe bridging, learning, stp, oam, irb software
1800466
Major		Hamilton :: LC4800 :: Initial Sync values not streaming
Product-Group=evo		Hamilton :: LC4800 :: Initial Sync values not streaming

Resolved In:
PR NumberSynopsisCategory: ZT/YT pfe l3 forwarding issues
1969570
Major		Traffic drop may occur on AFT platforms due to incorrect TPID programming during configuration
Product-Group=evo		On MX platforms with line cards MPC10/MPC11/LC4800/LC9600 or MX304, MX301, the TPID(Tag Protocol Identifier) for the unicast encapsulation next hop to be incorrectly programmed as 0x0 if the output interface is RLT . As a result, packets may be dropped by the PFE with an "unknown family" exception, causing traffic impact.

Resolved In: evo:26.2R2-EVO evo:26.4R1-EVO junos:26.2R2 junos:26.4R1
PR NumberSynopsisCategory: Configuration mgmt, ffp, load-action, commit processing
1751574
Major		Netconf RPC commit fails due to commit warning received for unprotect operation, CLI commit completes with warning
Product-Group=evo		In Netconf private edit configuration session, commit RPC fails when unprotect operation is performed.

Resolved In:
PR NumberSynopsisCategory: ACX724 hwd issues
1966944
Minor		Persistent hwdre anomaly alarm after a hardware alarm condition is cleared on Junos OS Evolved platforms
Product-Group=evo		On all Junos OS Evolved platforms, a anomaly errors reported for application hwdre on node re0 can continue to be reported after an underlying hardware alarm condition has cleared because a stale alarm object is retained. For example, this can occur after a temperature threshold alarm is raised and subsequently cleared. This results in a false alarm indication but does not impact traffic forwarding, routing, hardware health, or services.

Resolved In: evo:25.4R2-EVO evo:26.4R1-EVO junos:25.4R2 junos:26.4R1