Juniper Networks Junos OS
822 vulnérabilités publiées citent ce produit. Les 200 plus récentes sont listées.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-101954 | 25.2 – < 25.2R2-S2 ; 25.4 – < 25.4R1-S3 ; 26.2 – < 26.2R1-S2 | Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-101952 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabled | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101949 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: In a scenario with VPN-flowspec and BMP monitoring a specific BGP update causes an rpd crash | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101964 | 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; 24.4 – < 24.4R2-S5 ; … | Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP message | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101963 | 25.2 – < 25.2R2-S2 ; 25.4 – < 25.4R1-S3 ; 26.2 – < 26.2R1-S2 | Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101962 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101961 | 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; 24.4 – < 24.4R2-S5 ; … | Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when an ECMP qualifier is used in an import policy | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101959 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A malformed LSP-ping causes an rpd crash | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101983 | 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; 24.4 – < 24.4R2-S5 ; … | Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-101982 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used | CRITICAL 9.3 | 0.6 % | ||
| CVE-2026-101981 | 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; 24.4 – < 24.4R2-S5 ; … | Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when LDP is enabled | HIGH 8.7 | 0.2 % | ||
| CVE-2026-101979 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A network attacker causes root-level code execution or denial of service when SNMP and AAA are enabled | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101976 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: In a non-4byte-AS scenario a specific BGP update causes an rpd crash | HIGH 8.7 | 0.5 % | ||
| CVE-2026-101975 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: Improper OSPF LSA validation causes an rpd crash when prefix-SID best-route installation is used | HIGH 7.1 | 0.2 % | ||
| CVE-2026-101972 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: Malformed OSPF packets causes routing disruption when OSPF is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102077 | < 23.2R2-S4 ; 23.4 – < 23.4R2-S5 ; 24.2 – < 24.2R2 | Junos OS: MX Series with SPC3: In a source NAT scenario malformed packets will lead to resource leaks and eventually traffic stops | HIGH 8.7 | 0.3 % | ||
| CVE-2026-33798 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: SRX Series: An attacker causes remote code execution when SRX chassis-cluster is enabled | HIGH 8.7 | 0.4 % | ||
| CVE-2026-33796 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled | CRITICAL 9.3 | 0.6 % | ||
| CVE-2026-33795 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP Prefix-SID routes are re-advertised | HIGH 8.7 | 0.4 % | ||
| CVE-2026-33792 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: SRX Series: An attacker causes remote code execution and denial of service when a GRE tunnel is configured | CRITICAL 9.3 | 0.6 % | ||
| CVE-2026-33789 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in den… | CRITICAL 9.2 | 0.7 % | ||
| CVE-2026-102185 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when EVPN multihoming preference-based DF election is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-102184 | 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; 24.4 – < 24.4R2-S5 ; … | Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crash | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102183 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: If in a BGP EVPN scenario a malformed NLRI is received rpd crashes | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102182 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-102180 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes an rpd crash when BGP RIB streaming telemetry is in use | HIGH 8.7 | 0.4 % | ||
| CVE-2026-102179 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP EVPN RIB telemetry is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-102178 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malformed flowspec NLRI causes routing-engine compromise | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-102177 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An out-of-bounds write causes an rpd crash when IS-IS backup selection is used | HIGH 7.2 | 0.3 % | ||
| CVE-2026-102176 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: Specific packets cause SDK service crash or Routing Engine compromise when the SDK service and JDAF is enabled | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102175 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is used | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-102174 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: SRX Series: An authenticated remote-access VPN client causes iked denial of service or root-level code execution when JIMS iden… | HIGH 8.7 | 0.6 % | ||
| CVE-2026-102061 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes root code execution when SZTP DHCP provisioning is used | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102060 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: MX Series, ACX Series: An attacker causes a routing daemon crash when multicast lawful intercept is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102059 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: EX Series, SRX Series, QFX Series: A rogue DHCP server causes root-level command execution when the phone-… | HIGH 8.7 | 3.9 % | ||
| CVE-2026-102058 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes a bfdd denial of service when BFD is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102057 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: An attacker causes DHCP service disruption during DHCP client operation | HIGH 8.7 | 0.4 % | ||
| CVE-2026-102056 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes denial of service and information disclosure when Ethernet CFM is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102055 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remote code execution and denial of service when enhanced CFM is… | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102054 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configured | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-102053 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-102052 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-client feature is used | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102051 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion when LLDP fast receive processing is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102050 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of service when LLDP is enabled | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102049 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code execution when Unified Access Policy is enabled | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102048 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: An attacker causes l2cpd crash when FNP is used with VLAN-VPLS encapsulation enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102047 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes l2cpd denial of service when MVRP is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102046 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: MX Series: An attacker causes a Routing Engine denial of service when SCTP service is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102044 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes a routing control-plane denial of service when BGP-LS traffic engineering is enabled | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102043 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when MPLS-TE fast reroute is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102042 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP associated-bidirectional LSP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102041 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when RSVP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102040 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker crashes the routing daemon when co-routed bidirectional RSVP LSPs are used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102039 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes routing-process denial of service when GMPLS EVPL dynamic transport is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102037 | 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; 24.4 – < 24.4R2-S5 ; … | Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used | CRITICAL 9.2 | 0.5 % | ||
| CVE-2026-102036 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An EVPN default-gateway route burst causes l2ald denial of service | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102035 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes a denial of service when MC-LAG IRB MAC synchronization is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102034 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LAG ICCP MAC synchronization is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102033 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes denial of service when MC-LAG MAC synchronization is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102032 | 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; 24.4 – < 24.4R2-S5 ; … | Junos OS and Junos OS Evolved: Unintended l2ald memory allocation causes a denial of service when static MAC IP configurations are present | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102030 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102029 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when an MSDP or PIM policy uses AS-path expansion | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102028 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes an rpd crash when VPLS auto-discovery is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102027 | 24.4 – < 24.4R2-S5 ; 25.2 – < 25.2R2-S2 ; 25.4 – < 25.4R1-S3 ; … | Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath next-hops are processed | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102026 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102025 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A BGP route-processing error causes rpd crash when extended next-hop tunneling and SRv6 service processing… | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102024 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP extended-nexthop-tunnel is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102022 | 24.4 – < 24.4R2-S5 ; 25.2 – < 25.2R2-S2 ; 25.4 – < 25.4R1-S3 ; … | Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when BGP-LS traffic-engineering is enabled | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102021 | 24.4 – < 24.4R2-S5 ; 25.2 – < 25.2R2-S2 ; 25.4 – < 25.4R1-S3 ; … | Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MPLS-TE error processing is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102020 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when BGP-LS TED export is enabled | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102019 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: Malformed RIPv2 messages cause routing service disruption when RIP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102018 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: Malformed PIM Bidir DF-Election messages cause routing service disruption when bidirectional PIM is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102017 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes routing-plane denial of service when Auto-RP mapping is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102016 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes a routing outage when BGP MVPN signaling is enabled | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102015 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes root code execution when 802.1X authentication is used | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102014 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: An attacker causes authd to crash when subscriber RADIUS authentication is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-102013 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes na-grpcd to crash when the InitialSync service is used | MEDIUM 6.7 | 0.2 % | ||
| CVE-2026-102011 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP link protection is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102000 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101999 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101971 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes routing protocol daemon crash when OSPFv3 is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101970 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101969 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An unauthenticated attacker causes rpd denial of service when IPv6 PIM is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101968 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd heap memory disclosure when Rosen-MVPN data-MDT i… | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-101946 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosure when IPv6 LDP is used | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-101945 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes routing daemon denial of service when EVPN BGP is enabled | HIGH 8.7 | 0.5 % | ||
| CVE-2026-101944 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes a routing protocol daemon denial of service when EVPN is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-101943 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes rpd crash and denial of service when EVPN is configured | HIGH 8.7 | 0.5 % | ||
| CVE-2026-101942 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route signaling is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101941 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes an rpd crash when routing-policy resolution-map processing and policy event tracing are… | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101940 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP ISO-VPN egress protection is enabled | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101939 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A routing-policy table reference causes routing-daemon denial of service when source-based forwarding is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101938 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used | HIGH 7.1 | 0.2 % | ||
| CVE-2026-101937 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is used | HIGH 7.1 | 0.2 % | ||
| CVE-2026-101936 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101934 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventd | MEDIUM 6.7 | 0.2 % | ||
| CVE-2026-101927 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An unprivileged local attacker causes denial of service or privilege escalation | HIGH 8.6 | 0.1 % | ||
| CVE-2026-101984 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when labeled-unicast aggregate-label is configured | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101987 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101988 | 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; 24.4 – < 24.4R2-S5 ; … | Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker causes an rpd crash when LDP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101989 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An crafted LDP message causes an rpd crash when LDP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101990 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised | CRITICAL 9.3 | 0.6 % | ||
| CVE-2026-101992 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when automatic VPLS site ID is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101993 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An eBGP peer causes an rpd crash when VPLS automatic site-ID collision resolution is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101994 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald heap disclosure or crash | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101996 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash when MC-LAG is configured | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102064 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: An attacker causes an rpd crash when inter-AS MVPN ingress replication is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-102066 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: Malformed RSVP packet causes a rpd crash when RSVP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102071 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: Specific RSVP packet causes an rpd crash when associated bidirectional LSP is enabled | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101950 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Secure Vector Routing is enabled | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-101955 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used | CRITICAL 9.2 | 0.5 % | ||
| CVE-2026-101997 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile auth… | CRITICAL 9.2 | 0.4 % | ||
| CVE-2026-102062 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: SRX Series: An compromised HTTPS feed server can cause remote code execution when Security Intelligence is used | CRITICAL 9.2 | 0.4 % | ||
| CVE-2026-102078 | < 23.2R2-S5 ; 23.4 – < 23.4R2-S6 ; 24.2 – < 24.2R2-S3 ; … | Junos OS: SRX Series: A high volume of DNS traffic over TCP can lead to a flowd crash | HIGH 8.2 | 0.3 % | ||
| CVE-2026-102079 | 24.4 – < 24.4R2-S4 ; 25.2 – < 25.2R2-S1 ; 25.4 – < 25.4R1-S3 | Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands allows command injection | HIGH 8.5 | 0.7 % | ||
| CVE-2026-102080 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: MX Series: Malformed SyncE or PTP clock input causes continuous RE switchover | MEDIUM 6.0 | 0.2 % | ||
| CVE-2026-102081 | 23.4R2-S3 – < 23.4R2-S7 ; 24.2R2 – < 24.2R2-S3 ; 24.4 – < 24.4R2-S3 ; … | Junos OS: SRX4000 Series, SRX5000 Series and MX Series with SPC3: With application services configured, high session churn causes memory … | HIGH 8.7 | 0.4 % | ||
| CVE-2026-102082 | < 23.2R2-S5 ; 23.4 – < 23.4R2-S5 ; 24.2 – < 24.2R2-S2 ; … | Junos OS: SRX Series: If TLS session resumption is configured and a specific TLS message is received a PFE crash occurs | HIGH 8.2 | 0.3 % | ||
| CVE-2026-102083 | 23.2R2 – < 23.2R2-S7.7 ; 23.4R2 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: SRX Series: With WebFiltering enabled prolonged HTTP session load can cause a crash | HIGH 8.2 | 0.3 % | ||
| CVE-2026-102084 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S7 ; 24.2 – < 24.2R2-S4 ; … | Junos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code Execution | CRITICAL 9.2 | 0.5 % | ||
| CVE-2026-102086 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: SRX Series: Multiple DNS queries processed by SecIntel and DGA in the same session cause a flowd crash | HIGH 8.2 | 0.4 % | ||
| CVE-2026-102087 | < 23.2R2-S6 ; 23.4 – < 23.4R2-S7 ; 24.2 – < 24.2R2-S4 ; … | Junos OS and Junos OS Evolved: If in a traffic engineering scenario a specific valid BGP-LS attribute is received rpd crashes | HIGH 7.1 | 0.3 % | ||
| CVE-2026-103993 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: If a specific set of BGP communities is present and graceful-shutdown sender is added while attempting to … | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-101991 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabled | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-101986 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution | CRITICAL 9.3 | 0.6 % | ||
| CVE-2026-101951 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash if a malformed MCAST-TREE NLRI is received and readvertised | HIGH 8.7 | 0.4 % | ||
| CVE-2026-101957 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A remote BGP peer causes an rpd crash when long-lived graceful restart (LLGR) is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-102065 | 23.4 ; 24.2 – < 24.2R2-S5.5 ; 24.4 – < 24.4R2-S5 ; … | Junos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dynamic tunnels are enabled | HIGH 8.7 | 0.5 % | ||
| CVE-2026-101974 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclosure or service disruption when link-local TE processing is … | HIGH 7.1 | 0.3 % | ||
| CVE-2026-102067 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A specific RSVP packet causes an rpd crash when L2 LSP support is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101995 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disclosure and disruption | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-101948 | 25.2 – < 25.2R2-S2 ; 25.4 – < 25.4R1-S3 ; 26.2 – < 26.2R1-S2 | Junos OS and Junos OS Evolved: A specific BGP FlowSpec update causes an rpd crash when BGP FlowSpec import policy is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-101977 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when ephemeral configuration is used | HIGH 8.7 | 0.5 % | ||
| CVE-2026-101956 | 25.2 – < 25.2R2-S2 ; 25.4 – < 25.4R1-S3 ; 26.2 – < 26.2R1-S2 | Junos OS: Unauthorized root command execution when J-Web is enabled | CRITICAL 9.3 | 0.8 % | ||
| CVE-2026-101980 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Echo is enabled | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-102069 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: An ICCP peer causes dot1xd to crash when dot1x synchronization is enabled | HIGH 8.7 | 0.4 % | ||
| CVE-2026-102070 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is used | CRITICAL 9.2 | 0.5 % | ||
| CVE-2026-101973 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: Malformed packet causes pkid denial of service when certificate re-enrollment is used | HIGH 8.7 | 0.4 % | ||
| CVE-2026-102072 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: An authenticated attacker causes a denial of service when the gRPC extension-service is enabled | HIGH 7.1 | 0.4 % | ||
| CVE-2026-103994 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: A crafted OVSDB message crashes vgd and allows remote code execution | HIGH 8.7 | 0.4 % | ||
| CVE-2026-102063 | < 23.2R2-S7.7 ; 23.4 – < 23.4R2-S8.13 ; 24.2 – < 24.2R2-S5.5 ; … | Junos OS: MX Series: An unauthenticated network attacker causes an rpd crash when HFRR link protection is used | HIGH 7.1 | 0.3 % | ||
| CVE-2026-57054 | < 23.2R2-S7 ; 23.4 – < 23.4R2-S8 ; 24.2 – < 24.2R2-S5 ; … | Junos OS: MX Series: Web filtering doesn't block specifically formatted URLs | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-57032 | < 23.2R2-S7 ; 23.4 – < 23.4R2-S8 ; 24.2 – < 24.2R2-S5 ; … | Junos OS: EX Series: Subscribing to an unsupported telemetry sensor path causes fxpc process crash | HIGH 7.1 | 0.4 % | ||
| CVE-2026-57031 | 23.2R2-S1 – < 23.2R2-S7 ; 23.4R2 – < 23.4R2-S7 ; 24.2 – < 24.2R2-S3 ; … | Junos OS: MX Series: For subscribers configured on static interfaces, input filters are not in effect | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-57030 | 24.2 – < 24.2R2-S3 ; 24.4 – < 24.4R2-S1 ; 25.2 – < 25.2R1-S2 | Junos OS: SRX Series: Flow sessions are not getting cleared leading to a DoS | HIGH 8.2 | 0.4 % | ||
| CVE-2026-57027 | < 23.2R2-S7 ; 23.4 – < 23.4R2-S7 ; 24.2 – < 24.2R2-S4 ; … | Junos OS: EX4100 Series, EX4400: With sFlow configured in a VC scenario multicast traffic leads to an FPC crash | HIGH 7.1 | 0.3 % | ||
| CVE-2026-57026 | < 23.2R2-S7 ; 23.4 – < 23.4R2-S8 ; 24.2 – < 24.2R2-S5 ; … | Junos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invite causes a flowd crash | HIGH 8.7 | 0.5 % | ||
| CVE-2026-57025 | < 23.2R2-S7 ; 23.4 – < 23.4R2-S7 ; 24.2 – < 24.2R2 ; … | Junos OS and Junos OS Evolved: EX Series, QFX Series, MX Series: A specific 'show l2-learning/ethernet-switching' command causes l2ald crash | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-57024 | < 23.2R2-S7 ; 23.4 – < 23.4R2-S6 ; 24.2 – < 24.2R2-S3 ; … | Junos OS: MX with SPC3, SRX Series: Repeated VPN negotiation failures will eventually cause iked to crash continuously | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-57023 | 23.4 – < 23.4R2-S7 ; 24.2 – < 24.2R2-S4 ; 24.4 – < 24.4R2-S3 ; … | Junos OS: MX with SPC3, SRX Series: A specifically malformed TCP packet causes a flowd crash | HIGH 8.7 | 0.5 % | ||
| CVE-2026-57022 | < 23.2R2-S4 ; 23.4 – < 23.4R2-S5 ; 24.2 – < 24.2R2 | Junos OS: MX Series with SPC3, SRX Series: Specific packet in response to a TCP connection establishment by the affected device can crash… | HIGH 8.2 | 0.4 % | ||
| CVE-2026-57021 | 23.2 – < 23.2R2-S7 ; 23.4 – < 23.4R2-S8 ; 24.2 – < 24.2R2-S4 ; … | Junos OS: SRX Series: If VPN compliance-check is configured an attacker can cause http-gk process crash | MEDIUM 6.9 | 0.5 % | ||
| CVE-2026-57020 | < 23.2R2-S7 ; 23.4 – < 23.4R2-S8 ; 24.2 – < 24.2R2-S4 ; … | Junos OS: QFX10000 Series: IPv6 multicast traffic received on non-IRB interfaces causes a multicast flood | HIGH 7.1 | 0.3 % | ||
| CVE-2026-57019 | < 23.2R2-S6 ; 23.4 – < 23.4R2-S7 ; 24.2 – < 24.2R2-S4 ; … | Junos OS: MX Series: Specific traffic causes an FPC to reset | HIGH 7.1 | 0.3 % | ||
| CVE-2026-33802 | 23.2R2 – < 23.2R2-S6 ; 23.4 – < 23.4R2-S8 ; 24.2 – < 24.2R2-S4 ; … | Junos OS: EX Series: Unauthorized users can execute service-impacting CLI command | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-33801 | 25.2 – < 25.2R2 | Junos OS and Junos OS Evolved: When a specifically malformed BGP route update is received RPD crashes | HIGH 7.1 | 0.3 % | ||
| CVE-2026-33800 | < 23.2R2-S7 ; 23.4 – < 23.4R2-S8 ; 24.2 – < 24.2R2-S4 ; … | Junos OS: MX Series: In a VC scenario a high rate of micro-BFD session flaps will cause an FPC crash | HIGH 7.1 | 0.3 % | ||
| CVE-2026-33799 | < 21.2R3-S8 ; 21.4 – < 21.4R3-S7 ; 22.1 – < 22.1R3-S6 ; … | Junos OS and Junos OS Evolved: Receipt of a specific SNMPv3 request results in memory leak and eventual snmpd crash | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-21901 | 22.3 – < 22.3R3-S5 ; 22.4 – < 22.4R3-S10 ; 23.2 – < 23.2R2-S7 ; … | Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash | MEDIUM 6.7 | 0.2 % | ||
| CVE-2026-33791 | < 22.4R3-S8 ; 23.2 – < 23.2R2-S5 ; 23.4 – < 23.4R2-S7 ; … | Junos OS and Junos OS Evolved: Execution of crafted CLI commands allows for arbitrary shell injection as root | HIGH 8.4 | 0.7 % | ||
| CVE-2026-33790 | < 21.2R3-S10 ; 21.4 – < 21.4R3-S12 ; 22.2 – < 22.2R3-S8 ; … | Junos OS: SRX Series: In a NAT64 configuration, receipt of a specific, malformed ICMPv6 packet will cause the srxpfe process to crash and… | HIGH 8.7 | 0.3 % | ||
| CVE-2026-33787 | < 23.2R2-S6 ; 23.4 – < 23.4R2-S7 ; 24.2 – < 24.2R2-S2 ; … | Junos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specific show command is executed chassisd crashes | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-33785 | 24.4 – < 24.4R2-S3 ; 25.2 – < 25.2R2 | Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands in a JDM/CSDS scenario | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-33781 | 24.4 – < 24.4R2 ; 25.2 – < 25.2R1-S1, 25.2R2 | Junos OS: EX Series, QFX Series: In a VXLAN scenario when specific control protocol packets are received, memory leaks and eventually no … | HIGH 7.1 | 0.2 % | ||
| CVE-2026-33778 | < 22.4R3-S9 ; 23.2 – < 23.2R2-S6 ; 23.4 – < 23.4R2-S7 ; … | Junos OS: SRX Series, MX Series: When a specifically malformed first ISAKMP packet is received kmd/iked crashes | HIGH 8.7 | 0.3 % | ||
| CVE-2026-33776 | < 22.4R3-S8 ; 23.2 – < 23.2R2-S6 ; 23.4 – < 23.4R2-S6 ; … | Junos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive information | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-33774 | < 23.2R2-S6 ; 23.4 – < 23.4R2-S7 ; 24.2 – < 24.2R2 ; … | Junos OS: MX Series: Firewall filters on lo0.<non-0> in the default routing instance are not in effect | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-33797 | 25.2 – < 25.2R2 | Junos OS and Junos OS Evolved: An attacker sending a specific genuine BGP packet causes a BGP reset | HIGH 7.1 | 0.2 % | ||
| CVE-2026-33779 | < 22.4R3-S9 ; 23.2 – < 23.2R2-S6 ; 23.4 – < 23.4R2-S7 ; … | Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communication | HIGH 8.3 | 0.1 % | ||
| CVE-2026-33775 | < 22.4R3-S8 ; 23.2 – < 23.2R2-S5 ; 23.4 – < 23.4R2-S6 ; … | Junos OS: MX Series: Mismatch between configured and received packet types causes memory leak in bbe-smgd | HIGH 7.1 | 0.2 % | ||
| CVE-2026-33782 | < 22.4R3-S1 ; 23.2 – < 23.2R2 ; 23.4 – < 23.4R2 | Junos OS: MX Series: In specific DHCPv6 scenarios jdhcpd memory increases continuously with subscriber logouts | HIGH 8.7 | 0.3 % | ||
| CVE-2026-33780 | < 22.4R3-S5 ; 23.2 – < 23.2R2-S3 ; 23.4 – < 23.4R2-S4 ; … | Junos OS and Junos OS Evolved: In an EVPN-MPLS scenario churn of ESI routes causes a memory leak in l2ald | HIGH 7.1 | 0.2 % | ||
| CVE-2026-33773 | 23.4R2-S6 – < 23.4R2-S7 ; 24.2R2-S3 – < 24.2R2-S4 | Junos OS: EX Series, QFX Series: If the same egress filter is configured on both an IRB and a physical interface one of those is not applied | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-33786 | 24.4 – < 24.4R1-S3, 24.4R2 | Junos OS: SRX1600, SRX2300, SRX4300: When a specific show command is executed chassisd crashes | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-21916 | < 23.2R2-S7 ; 23.4 – < 23.4R2-S6 ; 24.2 – < 24.2R2-S3 ; … | Junos OS: A low privileged user can escalate their privileges so that they can login as root | HIGH 7.0 | 0.1 % | ||
| CVE-2026-21919 | 23.4 – < 23.4R2-S4 ; 24.2 – < 24.2R2-S1 ; 24.4 – < 24.4R1-S3, 24.4R2 | Junos OS and Junos OS Evolved: A high frequency of connecting and disconnecting NETCONF sessions causes management unavailability | HIGH 7.1 | 0.2 % | ||
| CVE-2026-33793 | < 22.4R3-S7 ; 23.2 – < 23.2R2-S4 ; 23.4 – < 23.4R2-S6 ; … | Junos OS and Junos OS Evolved: When an unsigned Python op script configuration is present, a local low privileged user can compromise the… | HIGH 8.5 | 0.2 % | ||
| CVE-2025-30650 | < 22.4R3-S8 ; 23.2 – < 23.2R2-S6 ; 23.4 – < 23.4R2-S6 ; … | Junos OS: Privileged local user can gain access to a Linux-based FPC as root | HIGH 8.4 | 0.1 % | ||
| CVE-2026-21921 | < 22.4R3-S8 ; 23.2 – < 23.2R2-S5 ; 23.4 – < 23.4R2 | Junos OS and Junos OS Evolved: When telemetry collectors are frequently subscribing and unsubscribing to sensors chassisd or rpd will crash | HIGH 7.1 | 0.4 % | ||
| CVE-2026-21920 | 23.4 – < 23.4R2-S5 ; 24.2 – < 24.2R2-S1 ; 24.4 – < 24.4R2 | Junos OS: SRX Series: If a specific request is processed by the DNS subsystem flowd will crash | HIGH 8.7 | 0.5 % | ||
| CVE-2026-21918 | < 22.4R3-S7 ; 23.2 – < 23.2R2-S3 ; 23.4 – < 23.4R2-S4 ; … | Junos OS: SRX and MX Series: When TCP packets occur in a specific sequence flowd crashes | HIGH 8.7 | 0.4 % | ||
| CVE-2026-21917 | 23.2R2-S2 – < 23.2R2-S5 ; 23.4R2-S1 – < 23.4R2-S5 ; 24.2 – < 24.2R2-S2 ; … | Junos OS: SRX Series: Specifically malformed SSL packet causes FPC crash | HIGH 8.7 | 0.4 % | ||
| CVE-2026-21914 | < 22.4R3-S8 ; 23.2 – < 23.2R2-S5 ; 23.4 – < 23.4R2-S6 ; … | Junos OS: SRX Series: A specifically malformed GTP message will cause an FPC crash | HIGH 8.7 | 0.3 % | ||
| CVE-2026-21913 | 24.4 – < 24.4R2 ; 25.2 – < 25.2R1-S2, 25.2R2 | Junos OS: EX4000: A high volume of traffic destined to the device leads to a crash and restart | HIGH 8.7 | 0.4 % | ||
| CVE-2026-21912 | < 21.2R3-S10 ; 21.4 – < 21.4R3-S9 ; 22.2 – < 22.2R3-S7 ; … | Junos OS: MX10k Series: 'show system firmware' CLI command may lead to LC480 or LC2101 line card reset | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-21910 | < 21.4R3-S12 ; 22.2 – < 22.2* ; 22.4 – < 22.4R3-S8 ; … | Junos OS: EX4k Series, QFX5k Series: In an EVPN-VXLAN configuration link flaps cause Inter-VNI traffic drop | HIGH 7.1 | 0.3 % | ||
| CVE-2026-21909 | 23.2 – < 23.2R2 ; 23.4 – < 23.4R1-S2, 23.4R2 ; 24.1 – < 24.1R2 | Junos OS and Junos OS Evolved: Receipt of specific IS-IS update packet causes memory leak leading to RPD crash | HIGH 7.1 | 0.2 % | ||
| CVE-2026-21908 | 23.2R2-S1 – < 23.2R2-S5 ; 23.4R2 – < 23.4R2-S6 ; 24.2 – < 24.2R2-S3 ; … | Junos OS and Junos OS Evolved: Use after free vulnerability In 802.1X authentication daemon can cause crash of the dot1xd process | HIGH 7.5 | 0.3 % | ||
| CVE-2026-21906 | < 21.4R3-S12 ; 22.4 – < 22.4R3-S8 ; 23.2 – < 23.2R2-S5 ; … | Junos OS: SRX Series: With GRE performance acceleration enabled, receipt of a specific ICMP packet causes the PFE to crash | HIGH 8.7 | 0.5 % | ||
| CVE-2026-21905 | < 21.2R3-S10 ; 21.4 – < 21.4R3-S12 ; 22.4 – < 22.4R3-S8 ; … | Junos OS: SRX Series, MX Series with MX-SPC3 or MS-MPC: Receipt of multiple specific SIP messages results in flow management process crash | HIGH 8.7 | 0.4 % | ||
| CVE-2026-21903 | < 22.4R3-S7 ; 23.2 – < 23.2R2-S4 ; 23.4 – < 23.4R2 | Junos OS: Subscribing to telemetry sensors at scale causes all FPCs to crash | HIGH 7.1 | 0.4 % | ||
| CVE-2026-0203 | < 21.2R3-S9 ; 21.4 – < 21.4R3-S10 ; 22.2 – < 22.2R3-S7 ; … | Junos OS: Receipt of a specifically malformed ICMP packet causes an FPC restart | HIGH 7.1 | 0.3 % | ||
| CVE-2025-60011 | < 22.4R3-S8 ; 23.2 – < 23.2R2-S5 ; 23.4 – < 23.4R2-S6 ; … | Junos OS and Junos OS Evolved: Optional transitive BGP attribute is modified before propagation to peers causing sessions to flap | MEDIUM 6.9 | 0.5 % | ||
| CVE-2025-60007 | < 22.4R3-S8 ; 23.2 – < 23.2R2-S5 ; 23.4 – < 23.4R2-S6 ; … | Junos OS: A specifically crafted 'show chassis' command causes chassisd to crash | MEDIUM 6.8 | 0.1 % | ||
| CVE-2025-60003 | < 22.4R3-S8 ; 23.2 – < 23.2R2-S5 ; 23.4 – < 23.4R2-S6 ; … | Junos OS and Junos OS Evolved: BGP update with a set of specific attributes causes rpd crash | HIGH 8.7 | 0.4 % | ||
| CVE-2025-59961 | < 21.2R3-S10 ; 21.4 – < 21.4R3-S12 ; 22.2 – < 22.2* ; … | Junos OS and Junos OS Evolved: Unix socket used to control the jdhcpd process is world-writable | MEDIUM 6.8 | 0.1 % | ||
| CVE-2025-59960 | < 21.2R3-S10 ; 21.4 – < 21.4R3-S12 ; 22.2 – < 22.2* ; … | Junos OS and Junos OS Evolved: DHCP Option 82 messages from clients being passed unmodified to the DHCP server | MEDIUM 6.3 | 0.3 % | ||
| CVE-2025-59959 | < 22.4R3-S8 ; 23.2 – < 23.2R2-S5 ; 23.4 – < 23.4R2-S5 ; … | Junos OS and Junos OS Evolved: Executing a specific show command leads to an rpd crash | MEDIUM 6.8 | 0.1 % | ||
| CVE-2025-60010 | < 22.4R3-S8 ; 23.2 – < 23.2R2-S4 ; 23.4 – < 23.4R2-S5 ; … | Junos OS and Junos OS Evolved: Device allows login for user with expired password | MEDIUM 5.3 | 0.2 % | ||
| CVE-2025-60004 | 23.4R2-S3 – < 23.4R2-S5 ; 24.2R2 – < 24.2R2-S1 ; 24.4R1 – < 24.4R1-S3, 24.4R2 | Junos OS and Junos OS Evolved: Specific BGP EVPN update message causes rpd crash | HIGH 8.7 | 0.4 % |