Juniper Networks Junos OS Evolved
375 published vulnerabilities name this product. The 200 most recent are listed.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-101954 | 25.2 – < 25.2R2-S2-EVO ; 25.4 – < 25.4R1-S3-EVO ; 26.2 – < 26.2R1-S2-EVO ; … | Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-101952 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabled | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101949 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: In a scenario with VPN-flowspec and BMP monitoring a specific BGP update causes an rpd crash | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101964 | 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; 24.4 – < 24.4R2-S5-EVO ; … | Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP message | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101963 | 25.2 – < 25.2R2-S2-EVO ; 25.4 – < 25.4R1-S3-EVO ; 26.2 – < 26.2R1-S2-EVO ; … | Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101962 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101961 | 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; 24.4 – < 24.4R2-S5-EVO ; … | Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when an ECMP qualifier is used in an import policy | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101959 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A malformed LSP-ping causes an rpd crash | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101983 | 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; 24.4 – < 24.4R2-S5-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-101982 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used | CRITICAL 9.3 | 0.6 % | ||
| CVE-2026-101981 | 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; 24.4 – < 24.4R2-S5-EVO ; … | Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when LDP is enabled | HIGH 8.7 | 0.2 % | ||
| CVE-2026-101979 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A network attacker causes root-level code execution or denial of service when SNMP and AAA are enabled | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101976 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: In a non-4byte-AS scenario a specific BGP update causes an rpd crash | HIGH 8.7 | 0.5 % | ||
| CVE-2026-101975 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: Improper OSPF LSA validation causes an rpd crash when prefix-SID best-route installation is used | HIGH 7.1 | 0.2 % | ||
| CVE-2026-101972 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: Malformed OSPF packets causes routing disruption when OSPF is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-33798 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: SRX Series: An attacker causes remote code execution when SRX chassis-cluster is enabled | HIGH 8.7 | 0.4 % | ||
| CVE-2026-33796 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled | CRITICAL 9.3 | 0.6 % | ||
| CVE-2026-33795 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP Prefix-SID routes are re-advertised | HIGH 8.7 | 0.4 % | ||
| CVE-2026-33789 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in den… | CRITICAL 9.2 | 0.7 % | ||
| CVE-2026-102185 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when EVPN multihoming preference-based DF election is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-102184 | 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; 24.4 – < 24.4R2-S5-EVO ; … | Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crash | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102183 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: If in a BGP EVPN scenario a malformed NLRI is received rpd crashes | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102180 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes an rpd crash when BGP RIB streaming telemetry is in use | HIGH 8.7 | 0.4 % | ||
| CVE-2026-102179 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP EVPN RIB telemetry is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-102178 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malformed flowspec NLRI causes routing-engine compromise | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-102177 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An out-of-bounds write causes an rpd crash when IS-IS backup selection is used | HIGH 7.2 | 0.3 % | ||
| CVE-2026-102175 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is used | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-102061 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes root code execution when SZTP DHCP provisioning is used | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102060 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: MX Series, ACX Series: An attacker causes a routing daemon crash when multicast lawful intercept is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102059 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: EX Series, SRX Series, QFX Series: A rogue DHCP server causes root-level command execution when the phone-… | HIGH 8.7 | 3.9 % | ||
| CVE-2026-102058 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes a bfdd denial of service when BFD is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102056 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes denial of service and information disclosure when Ethernet CFM is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102055 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remote code execution and denial of service when enhanced CFM is… | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102054 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configured | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-102053 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-102052 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-client feature is used | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102051 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion when LLDP fast receive processing is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102050 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of service when LLDP is enabled | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102049 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code execution when Unified Access Policy is enabled | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102047 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes l2cpd denial of service when MVRP is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102045 | 24.4 – < 24.4R2-S5-EVO ; 25.2 – < 25.2R2-S2-EVO ; 25.4 – < 25.4R1-S3-EVO ; … | Junos OS Evolved: An crafted LACP frame causes lacpd to crash when LACP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102044 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes a routing control-plane denial of service when BGP-LS traffic engineering is enabled | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102043 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when MPLS-TE fast reroute is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102042 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP associated-bidirectional LSP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102041 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when RSVP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102040 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker crashes the routing daemon when co-routed bidirectional RSVP LSPs are used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102039 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes routing-process denial of service when GMPLS EVPL dynamic transport is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102036 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An EVPN default-gateway route burst causes l2ald denial of service | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102035 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes a denial of service when MC-LAG IRB MAC synchronization is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102034 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LAG ICCP MAC synchronization is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102033 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes denial of service when MC-LAG MAC synchronization is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102032 | 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; 24.4 – < 24.4R2-S5-EVO ; … | Junos OS and Junos OS Evolved: Unintended l2ald memory allocation causes a denial of service when static MAC IP configurations are present | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102031 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled | CRITICAL 9.3 | 2.1 % | ||
| CVE-2026-102030 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102029 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when an MSDP or PIM policy uses AS-path expansion | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102028 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes an rpd crash when VPLS auto-discovery is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102027 | 24.4 – < 24.4R2-S5-EVO ; 25.2 – < 25.2R2-S2-EVO ; 25.4 – < 25.4R1-S3-EVO ; … | Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath next-hops are processed | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102026 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102025 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A BGP route-processing error causes rpd crash when extended next-hop tunneling and SRv6 service processing… | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102024 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP extended-nexthop-tunnel is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102023 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS Evolved: An attacker causes denial of service via SNMP when firewall counters are used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102022 | 24.4 – < 24.4R2-S5-EVO ; 25.2 – < 25.2R2-S2-EVO ; 25.4 – < 25.4R1-S3-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when BGP-LS traffic-engineering is enabled | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102021 | 24.4 – < 24.4R2-S5-EVO ; 25.2 – < 25.2R2-S2-EVO ; 25.4 – < 25.4R1-S3-EVO ; … | Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MPLS-TE error processing is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102020 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when BGP-LS TED export is enabled | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102019 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: Malformed RIPv2 messages cause routing service disruption when RIP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102018 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: Malformed PIM Bidir DF-Election messages cause routing service disruption when bidirectional PIM is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102017 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes routing-plane denial of service when Auto-RP mapping is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102016 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes a routing outage when BGP MVPN signaling is enabled | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102015 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes root code execution when 802.1X authentication is used | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102013 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes na-grpcd to crash when the InitialSync service is used | MEDIUM 6.7 | 0.2 % | ||
| CVE-2026-102012 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS Evolved: An attacker causes na-grpcd to crash when gRPC telemetry is enabled | HIGH 8.7 | 0.6 % | ||
| CVE-2026-102011 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP link protection is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102000 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101999 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101971 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes routing protocol daemon crash when OSPFv3 is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101970 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101969 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An unauthenticated attacker causes rpd denial of service when IPv6 PIM is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101968 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd heap memory disclosure when Rosen-MVPN data-MDT i… | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-101946 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosure when IPv6 LDP is used | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-101945 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes routing daemon denial of service when EVPN BGP is enabled | HIGH 8.7 | 0.5 % | ||
| CVE-2026-101944 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes a routing protocol daemon denial of service when EVPN is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-101943 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes rpd crash and denial of service when EVPN is configured | HIGH 8.7 | 0.5 % | ||
| CVE-2026-101942 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route signaling is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101941 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes an rpd crash when routing-policy resolution-map processing and policy event tracing are… | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101940 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP ISO-VPN egress protection is enabled | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101939 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A routing-policy table reference causes routing-daemon denial of service when source-based forwarding is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101938 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used | HIGH 7.1 | 0.2 % | ||
| CVE-2026-101934 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventd | MEDIUM 6.7 | 0.2 % | ||
| CVE-2026-101927 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An unprivileged local attacker causes denial of service or privilege escalation | HIGH 8.6 | 0.1 % | ||
| CVE-2026-101984 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when labeled-unicast aggregate-label is configured | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101987 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101988 | 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; 24.4 – < 24.4R2-S5-EVO ; … | Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker causes an rpd crash when LDP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101989 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An crafted LDP message causes an rpd crash when LDP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101990 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised | CRITICAL 9.3 | 0.6 % | ||
| CVE-2026-101992 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when automatic VPLS site ID is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101993 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An eBGP peer causes an rpd crash when VPLS automatic site-ID collision resolution is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101994 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald heap disclosure or crash | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101996 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash when MC-LAG is configured | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102064 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: An attacker causes an rpd crash when inter-AS MVPN ingress replication is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-102066 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: Malformed RSVP packet causes a rpd crash when RSVP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102071 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: Specific RSVP packet causes an rpd crash when associated bidirectional LSP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102085 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-102087 | < 23.2R2-S6-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S4-EVO ; … | Junos OS and Junos OS Evolved: If in a traffic engineering scenario a specific valid BGP-LS attribute is received rpd crashes | HIGH 7.1 | 0.3 % | ||
| CVE-2026-103993 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: If a specific set of BGP communities is present and graceful-shutdown sender is added while attempting to … | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-101991 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabled | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-101986 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution | CRITICAL 9.3 | 0.6 % | ||
| CVE-2026-101951 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash if a malformed MCAST-TREE NLRI is received and readvertised | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101957 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A remote BGP peer causes an rpd crash when long-lived graceful restart (LLGR) is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102065 | 23.4 ; 24.2 – < 24.2R2-S5.6-EVO ; 24.4 – < 24.4R2-S5-EVO ; … | Junos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dynamic tunnels are enabled | HIGH 8.7 | 0.5 % | ||
| CVE-2026-101974 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclosure or service disruption when link-local TE processing is … | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102067 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A specific RSVP packet causes an rpd crash when L2 LSP support is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101995 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disclosure and disruption | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-101948 | 25.2 – < 25.2R2-S2-EVO ; 25.4 – < 25.4R1-S3-EVO ; 26.2 – < 26.2R1-S2-EVO ; … | Junos OS and Junos OS Evolved: A specific BGP FlowSpec update causes an rpd crash when BGP FlowSpec import policy is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-101977 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when ephemeral configuration is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-101965 | 24.4 – < 24.4R2-S5-EVO ; 25.2 – < 25.2R2-S2-EVO ; 25.4 – < 25.4R1-S3-EVO ; … | Junos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabled | HIGH 8.7 | 0.6 % | ||
| CVE-2026-101967 | 24.4 – < 24.4R2-S5-EVO ; 25.2 – < 25.2R2-S2-EVO ; 25.4 – < 25.4R1-S3-EVO ; … | Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used | CRITICAL 9.3 | 3.9 % | ||
| CVE-2026-102068 | < 23.2R2-S7.7-EVO ; 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; … | Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP key-chain authentication is used | CRITICAL 9.2 | 0.7 % | ||
| CVE-2026-101960 | 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; 24.4 – < 24.4R2-S5-EVO ; … | Junos OS Evolved: QFX Series: A BGP peer causes an rpd crash when global load balancing is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101978 | 24.4 – < 24.4R2-S5-EVO ; 25.2 – < 25.2R2-S2-EVO ; 25.4 – < 25.4R1-S3-EVO ; … | Junos OS Evolved: PTX Series: An attacker controlled gRPC response causes root-level compromise when zero-touch provisioning is used | HIGH 8.7 | 3.9 % | ||
| CVE-2026-101985 | 23.4 – < 23.4R2-S8.11-EVO ; 24.2 – < 24.2R2-S5.6-EVO ; 24.4 – < 24.4R2-S5-EVO ; … | Junos OS Evolved: PTX Series: An IS-IS peer causes an rpd crash when BIER over IS-IS is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101966 | 25.4 – < 25.4R1-S3-EVO ; 26.2 – < 26.2R1-S2-EVO ; 23.4X100 ; … | Junos OS Evolved: A crafted analytics sensor resource causes telemetry dial-out daemon denial of service | HIGH 8.8 | 0.4 % | ||
| CVE-2026-57029 | < 23.4R2-S7-EVO ; 24.2 – < 24.2R2-S5-EVO ; 24.4 – < 24.4R2-S3-EVO ; … | Junos OS Evolved: QFX Series: When sFlow collector reachability changes evo-pfemand process can crash | MEDIUM 6.0 | 0.2 % | ||
| CVE-2026-57028 | < 23.2R2-EVO | Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-57025 | < 23.2R2-S7-EVO ; 23.4 – < 23.4R2-S8-EVO ; 24.2 – < 24.2R2-EVO ; … | Junos OS and Junos OS Evolved: EX Series, QFX Series, MX Series: A specific 'show l2-learning/ethernet-switching' command causes l2ald crash | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-33803 | < 23.2R2-S7-EVO ; 23.4 – < 23.4R2-S8-EVO ; 24.2 – < 24.2R2-S5-EVO ; … | Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-33801 | 25.2 – < 25.2R2-EVO | Junos OS and Junos OS Evolved: When a specifically malformed BGP route update is received RPD crashes | HIGH 7.1 | 0.3 % | ||
| CVE-2026-33799 | < 21.2R3-S8-EVO ; 21.4 – < 21.4R3-S7-EVO ; 22.1 – < 22.1* ; … | Junos OS and Junos OS Evolved: Receipt of a specific SNMPv3 request results in memory leak and eventual snmpd crash | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-33794 | 24.4R2-EVO – < 24.4R2-S3-EVO ; 25.2 – < 25.2R2, 25.2R2-EVO | Junos OS Evolved: PTX Series: Receipt of repeated ECMP routing updates results in PFE crash | HIGH 8.2 | 0.4 % | ||
| CVE-2026-21901 | 23.2 – < 23.2R2-S7-EVO ; 23.4 – < 23.4R2-S8-EVO | Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash | MEDIUM 6.7 | 0.2 % | ||
| CVE-2026-33791 | < 22.4R3-S8-EVO ; 23.2 – < 23.2R2-S5-EVO ; 23.4 – < 23.4R2-S7-EVO ; … | Junos OS and Junos OS Evolved: Execution of crafted CLI commands allows for arbitrary shell injection as root | HIGH 8.4 | 0.7 % | ||
| CVE-2026-33783 | < 22.4R3-S9-EVO ; 23.2 – < 23.2R2-S6-EVO ; 23.4 – < 23.4R2-S7-EVO ; … | Junos OS Evolved: PTX Series: If SRTE tunnels provisioned via PCEP are present and specific gRPC queries are received evo-aftmand crashes | HIGH 7.1 | 0.2 % | ||
| CVE-2026-33776 | < 23.2R2-S6-EVO ; 23.4 – < 23.4R2-S6-EVO ; 24.2 – < 24.2R2-S4-EVO ; … | Junos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive information | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-33797 | 25.2 – < 25.2R2-EVO | Junos OS and Junos OS Evolved: An attacker sending a specific genuine BGP packet causes a BGP reset | HIGH 7.1 | 0.2 % | ||
| CVE-2026-33780 | all version prior to – < 22.4R3-S5-EVO ; 23.2 – < 23.2R2-S3-EVO ; 23.4 – < 23.4R2-S4-EVO ; … | Junos OS and Junos OS Evolved: In an EVPN-MPLS scenario churn of ESI routes causes a memory leak in l2ald | HIGH 7.1 | 0.2 % | ||
| CVE-2026-33788 | < 21.2R3-S8-EVO ; 21.4-EVO – < 21.4R3-S7-EVO ; 22.2-EVO – < 22.2R3-S4-EVO ; … | Junos OS Evolved: Local, authenticated attacker can gain privileged access to FPCs | HIGH 8.5 | 0.1 % | ||
| CVE-2026-21919 | 23.4 – < 23.4R2-S5-EVO ; 24.2 – < 24.2R2-S1-EVO ; 24.4 – < 24.4R1-S3-EVO, 24.4R2-EVO | Junos OS and Junos OS Evolved: A high frequency of connecting and disconnecting NETCONF sessions causes management unavailability | HIGH 7.1 | 0.2 % | ||
| CVE-2025-59969 | < 22.4R3-S8-EVO ; 23.2 – < 23.2R2-S5-EVO ; 23.4 – < 23.4R2-EVO ; … | Junos OS Evolved: QFX5000 Series and PTX Series: An attacker sending crafted multicast packets will cause evo-aftmand / evo-pfemand to cr… | HIGH 7.1 | 0.2 % | ||
| CVE-2026-33793 | < 22.4R3-S7-EVO ; 23.2 – < 23.2R2-S4-EVO ; 23.4 – < 23.4R2-S6-EVO ; … | Junos OS and Junos OS Evolved: When an unsigned Python op script configuration is present, a local low privileged user can compromise the… | HIGH 8.5 | 0.2 % | ||
| CVE-2026-21902 | 25.4 – < 25.4R1-S1-EVO, 25.4R2-EVO | Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root | CRITICAL 9.3 | 18 % | ||
| CVE-2026-21921 | < 22.4R3-S8-EVO ; 23.2 – < 23.2R2-S5-EVO ; 23.4 – < 23.4R2-EVO | Junos OS and Junos OS Evolved: When telemetry collectors are frequently subscribing and unsubscribing to sensors chassisd or rpd will crash | HIGH 7.1 | 0.4 % | ||
| CVE-2026-21911 | < 21.4R3-S7-EVO ; 22.2 – < 22.2R3-S4-EVO ; 22.3 – < 22.3R3-S3-EVO ; … | Junos OS Evolved: Flapping management interface causes MAC learning on label-switched interfaces to stop | HIGH 7.1 | 0.2 % | ||
| CVE-2026-21909 | 23.2 – < 23.2R2-EVO ; 23.4 – < 23.4R1-S2-EVO, 23.4R2-EVO ; 24.1 – < 24.1R2-EVO | Junos OS and Junos OS Evolved: Receipt of specific IS-IS update packet causes memory leak leading to RPD crash | HIGH 7.1 | 0.2 % | ||
| CVE-2026-21908 | 23.2R2-S1 – < 23.2R2-S5-EVO ; 23.4R2 – < 23.4R2-S6-EVO ; 24.2 – < 24.2R2-S3-EVO ; … | Junos OS and Junos OS Evolved: Use after free vulnerability In 802.1X authentication daemon can cause crash of the dot1xd process | HIGH 7.5 | 0.3 % | ||
| CVE-2025-60011 | < 22.4R3-S8-EVO ; 23.2 – < 23.2R2-S5-EVO ; 23.4 – < 23.4R2-S6-EVO ; … | Junos OS and Junos OS Evolved: Optional transitive BGP attribute is modified before propagation to peers causing sessions to flap | MEDIUM 6.9 | 0.5 % | ||
| CVE-2025-60003 | < 22.4R3-S8-EVO ; 23.2 – < 23.2R2-S5-EVO ; 23.4 – < 23.4R2-S6-EVO ; … | Junos OS and Junos OS Evolved: BGP update with a set of specific attributes causes rpd crash | HIGH 8.7 | 0.4 % | ||
| CVE-2025-59961 | < 22.4R3-S8-EVO ; 23.2 – < 23.2R2-S5-EVO ; 23.4 – < 23.4R2-S6-EVO ; … | Junos OS and Junos OS Evolved: Unix socket used to control the jdhcpd process is world-writable | MEDIUM 6.8 | 0.1 % | ||
| CVE-2025-59960 | < 21.4R3-S12-EVO ; 22.2 – < 22.2* ; 22.4 – < 22.4R3-S8-EVO ; … | Junos OS and Junos OS Evolved: DHCP Option 82 messages from clients being passed unmodified to the DHCP server | MEDIUM 6.3 | 0.3 % | ||
| CVE-2025-59959 | < 22.4R3-S8-EVO ; 23.2 – < 23.2R2-S5-EVO ; 23.4 – < 23.4R2-S6-EVO ; … | Junos OS and Junos OS Evolved: Executing a specific show command leads to an rpd crash | MEDIUM 6.8 | 0.1 % | ||
| CVE-2025-60010 | < 22.4R3-S8-EVO ; 23.2 – < 23.2R2-S4-EVO ; 23.4 – < 23.4R2-S5-EVO ; … | Junos OS and Junos OS Evolved: Device allows login for user with expired password | MEDIUM 5.3 | 0.2 % | ||
| CVE-2025-60006 | 24.2 – < 24.2R2-S2-EVO ; 24.4 – < 24.4R2-EVO | Junos OS Evolved: OS command injection vulnerabilities fixed | MEDIUM 4.8 | 1.0 % | ||
| CVE-2025-60004 | 23.4R2-S2-EVO – < 23.4R2-S5-EVO ; 24.2R2-EVO – < 24.2R2-S1-EVO ; 24.4R1-EVO – < 24.4R1-S3-EVO, 24.4R2-EVO | Junos OS and Junos OS Evolved: Specific BGP EVPN update message causes rpd crash | HIGH 8.7 | 0.4 % | ||
| CVE-2025-59967 | 23.2R2-EVO – < 23.2R2-S4-EVO ; 23.4R1-EVO – < 23.4R2-EVO | Junos OS Evolved: ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509: When specific valid multicast traffic is received on th… | HIGH 7.1 | 0.2 % | ||
| CVE-2025-59962 | 22.3 – < 22.3R3-S3-EVO ; 22.4 – < 22.4R3-EVO ; 23.2 – < 23.2R2-EVO | Junos OS and Junos OS Evolved: With BGP sharding enabled, change in indirect next-hop can cause RPD crash | MEDIUM 6.0 | 0.2 % | ||
| CVE-2025-59958 | < 22.4R3-EVO ; 23.2 – < 23.2R2-EVO | Junos OS Evolved: PTX Series: When a firewall filter rejects traffic these packets are erroneously sent to the RE | MEDIUM 6.9 | 0.3 % | ||
| CVE-2025-52961 | 23.2R1-EVO – < 23.2R2-S4-EVO ; 23.4-EVO – < 23.4R2-S4-EVO ; 24.2-EVO – < 24.2R2-EVO ; … | Junos OS Evolved: PTX Series except PTX10003: An unauthenticated adjacent attacker sending specific valid traffic can cause a memory leak… | HIGH 7.1 | 0.5 % | ||
| CVE-2025-52988 | < 22.4R3-S6-EVO ; 23.2-EVO – < 23.2R2-S1-EVO ; 23.4-EVO – < 23.4R1-S2-EVO, 23.4R2-EVO | Junos OS and Junos OS Evolved: Privilege escalation to root via CLI command 'request system logout' | HIGH 8.4 | 0.4 % | ||
| CVE-2025-52989 | < 22.4R3-S7-EVO ; 23.2-EVO – < 23.2R2-S4-EVO ; 23.4-EVO – < 23.4R2-S5-EVO ; … | Junos OS and Junos OS Evolved: Annotate configuration command can be used to change the configuration | MEDIUM 6.8 | 0.1 % | ||
| CVE-2025-52986 | < 22.2R3-S7-EVO ; 22.4-EVO – < 22.4R3-S7-EVO ; 23.2-EVO – < 23.2R2-S4-EVO ; … | Junos OS and Junos OS Evolved: When RIB sharding is configured each time a show command is executed RPD memory leaks | MEDIUM 6.8 | 0.1 % | ||
| CVE-2025-52985 | 23.2R2-S3-EVO – < 23.2R2-S4-EVO ; 23.4R2-S3-EVO – < 23.4R2-S5-EVO ; 24.2R2-EVO – < 24.2R2-S1-EVO ; … | Junos OS Evolved: When a control-plane firewall filter refers to a prefix-list with more than 10 entries it's not matching | MEDIUM 6.9 | 0.3 % | ||
| CVE-2025-52984 | < 22.4R3-S7-EVO ; 23.2-EVO – < 23.2R2-S3-EVO ; 23.4-EVO – < 23.4R2-S4-EVO ; … | Junos OS and Junos OS Evolved: When a static route points to a reject next-hop and a gNMI query for this route is processed, RPD crashes | HIGH 8.2 | 0.5 % | ||
| CVE-2025-52964 | < 21.4R3-S7-EVO ; 22.3 – < 22.3R3-S3-EVO ; 22.4 – < 22.4R3-S5-EVO ; … | Junos OS and Junos OS Evolved: Receipt of a specific BGP UPDATE causes an rpd crash on devices with BGP multipath configured | HIGH 7.1 | 0.3 % | ||
| CVE-2025-52953 | < 22.2R3-S7-EVO ; 22.4-EVO – < 22.4R3-S7-EVO ; 23.2-EVO – < 23.2R2-S4-EVO ; … | Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker sending a valid BGP UPDATE packet forces a BGP session reset | HIGH 7.1 | 0.3 % | ||
| CVE-2025-52958 | < 22.2R3-S6-EVO ; 22.4 – < 22.4R3-S6-EVO ; 23.2 – < 23.2R2-S3-EVO ; … | Junos OS and Junos OS Evolved: When route validation is enabled, BGP connection establishment failure causes RPD crash | MEDIUM 6.0 | 0.2 % | ||
| CVE-2025-52955 | < 21.2*-EVO ; 21.4 – < 21.4*-EVO ; 22.2 – < 22.2*-EVO ; … | Junos OS and Junos OS Evolved: When jflow/sflow is configured continuous logical interface flaps causes rpd crash and restart | HIGH 7.1 | 0.3 % | ||
| CVE-2025-52954 | < 22.2R3-S7-EVO ; 22.4 – < 22.4R3-S7-EVO ; 23.2 – < 23.2R2-S4-EVO ; … | Junos OS Evolved: A low-privileged user can execute arbitrary Junos commands and modify the configuration, thereby compromising the system | HIGH 8.5 | 0.2 % | ||
| CVE-2025-52949 | < 22.2R3-S7-EVO ; 22.4-EVO – < 22.4R3-S7-EVO ; 23.2-EVO – < 23.2R2-S4-EVO ; … | Junos OS and Junos OS Evolved: In an EVPN environment, receipt of specifically malformed BGP update causes RPD crash | HIGH 7.1 | 0.3 % | ||
| CVE-2025-52946 | < 22.4R3-S5-EVO ; 23.2-EVO – < 23.2R2-S3-EVO ; 23.4-EVO – < 23.4R2-S4-EVO ; … | Junos OS and Junos OS Evolved: With traceoptions enabled, receipt of malformed AS PATH causes RPD crash | HIGH 8.7 | 0.5 % | ||
| CVE-2025-30655 | < 21.2R3-S9-EVO ; 21.4-EVO – < 21.4R3-S8-EVO ; 22.2-EVO – < 22.2R3-S6-EVO ; … | Junos OS and Junos OS Evolved: A specific CLI command will cause an RPD crash when rib-sharding and update-threading is enabled | MEDIUM 6.8 | 0.1 % | ||
| CVE-2025-30654 | < 21.4R3-S10-EVO ; 22.2-EVO – < 22.2R3-S6-EVO ; 22.4-EVO – < 22.4R3-S5-EVO ; … | Junos OS and Junos OS Evolved: A local, low privileged user can access sensitive information | MEDIUM 6.8 | 0.2 % | ||
| CVE-2025-30653 | < 22.2R3-S4-EVO ; 22.4-EVO – < 22.4R3-S2-EVO ; 23.2-EVO – < 23.2R2-EVO ; … | Junos OS and Junos OS Evolved: LSP flap in a specific MPLS scenario leads to rpd crash | MEDIUM 6.0 | 0.2 % | ||
| CVE-2025-30652 | < 21.2R3-S9-EVO ; 21.4-EVO – < 21.4R3-S10-EVO ; 22.2-EVO – < 22.2R3-S6-EVO ; … | Junos OS and Junos OS Evolved: Executing a specific CLI command when asregex-optimized is configured causes an rpd crash | MEDIUM 6.8 | 0.2 % | ||
| CVE-2025-30651 | < 21.2R3-S9-EVO ; 21.4-EVO – < 21.4R3-S10-EVO ; 22.2-EVO – < 22.2R3-S6-EVO ; … | Junos OS and Junos OS Evolved: Receipt of a specific ICMPv6 packet causes a memory overrun leading to an rpd crash | HIGH 8.7 | 0.4 % | ||
| CVE-2025-30648 | 22.4 – < 22.4R3-S6-EVO ; 23.2 – < 23.2R2-S3-EVO ; 23.4 – < 23.4R2-S4-EVO ; … | Junos OS and Junos OS Evolved: Receipt of a specifically malformed DHCP packet causes jdhcpd process to crash | HIGH 7.1 | 0.2 % | ||
| CVE-2025-30646 | < 21.4R3-S10-EVO ; 22.2-EVO – < 22.2R3-S6-EVO ; 22.4-EVO – < 22.4R3-S6-EVO ; … | Junos OS and Junos OS Evolved: Receipt of a malformed LLDP TLV results in l2cpd crash | HIGH 7.1 | 0.2 % | ||
| CVE-2025-21597 | < 21.2R3-S6-EVO ; 21.3-EVO – < 21.3R3-S5-EVO ; 21.4-EVO – < 21.4R3-S4-EVO ; … | Junos OS and Junos OS Evolved: When BGP rib-sharding and update-threading are configured and a peer flaps, an rpd core is observed | MEDIUM 6.0 | 0.2 % | ||
| CVE-2025-21595 | < 21.2R3-S7-EVO ; 21.4-EVO – < 21.4R3-S4-EVO ; 22.2-EVO – < 22.2R3-S1-EVO ; … | Junos OS and Junos OS Evolved: In an EVPN-VXLAN scenario specific ARP or NDP packets cause FPC to crash | HIGH 7.1 | 0.3 % | ||
| CVE-2024-39564 | 22.4 – < 22.4R3-S3-EVO | Junos OS and Junos OS Evolved: Receipt of malformed BGP path attributes leads to RPD crash | HIGH 8.7 | 0.4 % | ||
| CVE-2025-21598 | 21.4R3-S7-EVO – < 21.4R3-S9-EVO ; 22.2R3-S4-EVO – < 22.2R3-S5-EVO ; 22.3R3-S2-EVO – < 22.3R3-S4-EVO ; … | Junos OS and Junos OS Evolved: When BGP traceoptions are configured, receipt of malformed BGP packets causes RPD to crash | HIGH 8.2 | 0.7 % | ||
| CVE-2025-21600 | 21.4-EVO – < 21.4R3-S9-EVO ; 22.2-EVO – < 22.2R3-S5-EVO ; 22.3-EVO – < 22.3R3-S4-EVO ; … | Junos OS and Junos OS Evolved: With certain BGP options enabled, receipt of specifically malformed BGP update causes RPD crash | HIGH 7.1 | 0.3 % | ||
| CVE-2025-21602 | 21.4 – < 21.4R3-S9-EVO ; 22.2 – < 22.2R3-S5-EVO ; 22.3 – < 22.3R3-S4-EVO ; … | Junos OS and Junos OS Evolved: Receipt of specially crafted BGP update packet causes RPD crash | HIGH 7.1 | 0.2 % | ||
| CVE-2025-21599 | 22.4-EVO – < 22.4R3-S5-EVO ; 23.2-EVO – < 23.2R2-S2-EVO ; 23.4-EVO – < 23.4R2-S2-EVO ; … | Junos OS Evolved: Receipt of specifically malformed IPv6 packets causes kernel memory exhaustion leading to Denial of Service | HIGH 8.7 | 0.6 % | ||
| CVE-2025-21593 | < 21.2R3-S9-EVO ; 21.4-EVO – < 21.4R3-S10-EVO ; 22.2-EVO – < 22.2R3-S5-EVO ; … | Junos OS and Junos OS Evolved: On SRv6 enabled devices, an attacker sending a malformed BGP update can cause the rpd to crash | HIGH 7.1 | 0.2 % | ||
| CVE-2024-47507 | < 21.4R3-S7-EVO ; 22.2 – < 22.2R3-S4-EVO ; 22.4 – < 22.4R3-EVO | Junos OS and Junos OS Evolved: BGP update message containing aggregator attribute with an ASN value of zero (0) is accepted | MEDIUM 6.9 | 0.3 % | ||
| CVE-2024-47509 | 21.4 – < 21.4R2-EVO ; 22.1 – < 22.1R2-EVO | Junos OS Evolved: Specific low privileged CLI commands and SNMP GET requests can trigger a resource leak #3 | HIGH 7.1 | 0.4 % | ||
| CVE-2024-47508 | 21.2 – < 21.2R3-S8-EVO ; 21.3 – < 21.3R3-EVO ; 21.4 – < 21.4R2-EVO, ; … | Junos OS Evolved: Specific low privileged CLI commands and SNMP GET requests can trigger a resource leak #2 | HIGH 7.1 | 0.4 % | ||
| CVE-2024-47505 | 21.4 – < 21.4R3-S7-EVO ; 22.1 – < 22.1R3-S6-EVO ; 22.2 – < 22.2R3-EVO ; … | Junos OS Evolved: Specific low privileged CLI commands and SNMP GET requests can trigger a resource leak #1 | HIGH 7.1 | 0.4 % | ||
| CVE-2024-47502 | < 21.4R3-S9-EVO ; 22.2 – < 22.2R3-S4-EVO ; 22.4 – < 22.4R3-S3-EVO ; … | Junos OS Evolved: TCP session state is not always cleared on the Routing Engine leading to DoS | HIGH 8.7 | 0.6 % | ||
| CVE-2024-47499 | < 21.2R3-S8-EVO ; 21.4 – < 21.4R3-S8-EVO ; 22.2 – < 22.2R3-S4-EVO ; … | Junos OS and Junos OS Evolved: In a BMP scenario receipt of a malformed AS PATH attribute can cause an RPD crash | HIGH 8.7 | 0.6 % | ||
| CVE-2024-47498 | < 21.4R3-S8-EVO ; 22.2-EVO – < 22.2R3-S5-EVO ; 22.4-EVO – < 22.4R3-EVO ; … | Junos OS Evolved: QFX5000 Series: Configured MAC learning and move limits are not in effect | HIGH 7.1 | 0.3 % | ||
| CVE-2024-47495 | < 21.2R3-S8-EVO ; 21.4-EVO – < 21.4R3-S8-EVO ; 22.2-EVO – < 22.2R3-S4-EVO ; … | Junos OS Evolved: In a dual-RE scenario a locally authenticated attacker with shell privileges can take over the device. | HIGH 8.4 | 0.2 % | ||
| CVE-2024-47491 | < 21.4R3-S8-EVO ; 22.2 – < 22.2R3-S4-EVO ; 22.4 – < 22.4R3-S3-EVO ; … | Junos OS and Junos OS Evolved: Receipt of a specific malformed BGP path attribute leads to an RPD crash | HIGH 8.2 | 0.6 % | ||
| CVE-2024-47490 | < 21.4R3-S9-EVO ; 22.2-EVO – < 22.2R3-S4-EVO ; 22.3-EVO – < 22.3R3-S3-EVO ; … | Junos OS Evolved: ACX 7000 Series: Receipt of specific transit MPLS packets causes resources to be exhausted | HIGH 7.7 | 0.6 % | ||
| CVE-2024-47489 | < 21.4R3-S8-EVO ; 22.2 – < 22.2R3-S4-EVO ; 22.3 – < 22.3R3-S4-EVO ; … | Junos OS Evolved: ACX Series: Receipt of specific transit protocol packets is incorrectly processed by the RE | MEDIUM 6.9 | 0.7 % | ||
| CVE-2024-39547 | < 21.4R3-S7-EVO ; 22.2-EVO – < 22.2R3-S4-EVO ; 22.3-EVO – < 22.3R3-S3-EVO ; … | Junos OS and Junos OS Evolved: cRPD: Receipt of crafted TCP traffic can trigger high CPU utilization | HIGH 8.7 | 1.0 % | ||
| CVE-2024-39544 | < 20.4R3-S9-EVO ; 21.2-EVO – < 21.2R3-S7-EVO ; 21.4-EVO – < 21.4R3-S5-EVO ; … | Junos OS Evolved: Low privileged local user able to view NETCONF traceoptions files | MEDIUM 5.1 | 0.2 % | ||
| CVE-2024-39534 | < 21.4R3-S8-EVO ; 22.2-EVO – < 22.2R3-S4-EVO ; 22.3-EVO – < 22.3R3-S4-EVO ; … | Junos OS Evolved: Connections to the network and broadcast address accepted | MEDIUM 5.3 | 0.7 % | ||
| CVE-2024-39526 | 19.3R1-EVO – < 21.2R3-S8-EVO ; 21.4-EVO – < 21.4R3-S7-EVO ; 22.1-EVO – < 22.1R3-S6-EVO ; … | Junos OS and Junos OS Evolved: MX Series with MPC10/MPC11/LC9600, MX304, EX9200, PTX Series: Receipt of malformed DHCP packets causes int… | HIGH 7.1 | 0.4 % | ||
| CVE-2024-39525 | < 21.2R3-S8-EVO ; 21.4-EVO – < 21.4R3-S8-EVO ; 22.2-EVO – < 22.2R3-S4-EVO ; … | Junos OS and Junos OS Evolved: When BGP traceoptions is enabled, receipt of specially crafted BGP packet causes RPD crash | HIGH 8.7 | 0.4 % | ||
| CVE-2024-39516 | < 21.4R3-S8-EVO ; 22.2-EVO – < 22.2R3-S5-EVO ; 22.3-EVO – < 22.3R3-S4-EVO ; … | Junos OS and Junos OS Evolved: With certain BGP options enabled, receipt of specifically malformed BGP update causes RPD crash | HIGH 8.7 | 0.4 % | ||
| CVE-2024-39515 | < 21.4R3-S8-EVO ; 22.2-EVO – < 22.2R3-S5-EVO ; 22.3-EVO – < 22.3R3-S4-EVO ; … | Junos OS and Junos OS Evolved: With BGP traceoptions enabled, receipt of specifically malformed BGP update causes RPD crash | HIGH 8.7 | 0.5 % |