Key points
- The vulnerability is a stack-based buffer overflow in the routing protocol daemon.
- Attackers need only be a configured BGP/EVPN peer to exploit the flaw.
- Junos OS Evolved suffers service crashes rather than full root code execution.
A critical security flaw in Juniper Networks Junos OS allows attackers to gain root-level control over network devices. The issue stems from a stack-based buffer overflow in the routing protocol daemon, known as rpd. According to National Vulnerability Database records, the weakness carries a CVSS score of 9.8, classifying it as critical.
Attackers do not need complex exploits; they simply need to be a configured Border Gateway Protocol or Ethernet VPN peer. By sending protocol-valid route advertisements for an EVPN-VPWS service, they can trigger the overflow. This grants them the ability to execute arbitrary code with root privileges on standard Junos OS installations. On Junos OS Evolved systems, the same action causes the routing daemon to crash, resulting in a denial of service.
In plain English
The routing software responsible for directing network traffic contains a memory handling error. When the system processes specific types of routing updates from trusted partners, it writes more data into a temporary memory space than it can hold. This overflow corrupts adjacent memory areas. On standard Junos OS, this corruption allows an attacker to insert and run their own commands with the highest level of system access. On the newer Junos OS Evolved platform, the system shuts down the routing process, causing a temporary loss of connectivity.
The background
The vulnerability affects multiple versions of Juniper Networks operating systems. Affected Junos OS versions include those before 23.2R2-S7.7, before 23.4R2-S8.13, before 24.2R2-S5.5, and before 24.4R2-S5. For Junos OS Evolved, affected versions are before 23.2R2-S7.7-EVO, before 23.4R2-S8.11-EVO, before 24.2R2-S5.6-EVO, and before 24.4R2-S5-EVO. The National Vulnerability Database lists the weakness under CWE-121. The flaw specifically targets the rpd component, which handles critical routing protocols.
What changes now
Network operators must verify their current software versions against the affected lists. If a device runs a vulnerable version, it is exposed to attacks from any configured BGP or EVPN peer. The severity rating of 9.8 indicates a high risk of exploitation. Managed service providers should prioritise updating or mitigating exposure on devices that interact with external peers via EVPN-VPWS services.
The attacker's path
Teams usually begin by mapping external peering relationships to identify trust boundaries. In this scenario, the attacker leverages an existing, authorised connection to inject malicious data. The technique relies on the system’s failure to validate input length within the routing daemon. This serves the initial access stage of an intrusion, granting immediate high-privilege control. Check whether your monitoring tools can detect anomalous route advertisement patterns from trusted peers, as this is the primary vector for exploitation.
What to do and how to stay safe: Juniper Networks
- Audit all BGP and EVPN peer configurations to identify external connections that could be abused.
- Verify current Junos OS and Junos OS Evolved versions against the affected lists provided by the vendor.
- Monitor routing daemon logs for unexpected crashes or unusual resource consumption during route updates.
- Implement strict input validation rules for EVPN-VPWS route advertisements where possible.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-101982?
The National Vulnerability Database assigns a CVSS score of 9.8 to this vulnerability, rating it as critical.
Does this affect Junos OS Evolved differently than Junos OS?
Yes, on Junos OS it allows root code execution, while on Junos OS Evolved it causes the routing daemon to crash.
What type of traffic triggers this vulnerability?
Protocol-valid route advertisements for an EVPN-VPWS service sent by a configured BGP/EVPN peer trigger the flaw.
