PHP object injection in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.3) lets a low-privilege authenticated attacker supply untrusted serialized data that the plugin deserializes, enabling arbitrary object instantiation and, where a usable gadget chain exists in the plugin or its dependencies, escalation to code execution or full site compromise. The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N and High confidentiality, integrity, and availability impact, and no user interaction is required; exploitation still depends on reaching the specific vulnerable deserialization endpoint and on the presence of a suitable gadget chain. No public exploit code was identified at time of analysis, and the CVE is not confirmed as actively exploited (CISA KEV).
Crafted SCTP network traffic can drive the netsctp.ko kernel module on Juniper MX Series routers running affected Junos OS releases into an infinite loop, stalling the SCTP processing path and producing a denial of service against the device. Exploitation is unauthenticated and requires no user interaction (PR:N/UI:N per the assessed vector) - the attacker only needs network reachability to a device that is actually processing SCTP traffic, which in practice means MX platforms used in telecom/mobile signaling roles; routers that do not handle SCTP are not exposed. The vendor has published an advisory and fixed releases, and no public exploit code or confirmed active exploitation was identified at time of analysis (this CVE is not associated with CISA KEV), so the primary risk driver is the size of the exposed, SCTP-handling MX population rather than demonstrated in-the-wild abuse.
Second-factor authentication bypass in TSplus Remote Access lets an attacker who already holds a valid username and password complete the login without ever supplying a valid MFA token, granting access to the protected applications and resources that MFA was meant to guard. The flaw is authenticated (PR:L) and remotely reachable over the network (AV:N) with no user interaction required, and it carries high confidentiality, integrity, and availability impact (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 8.7). No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV); however, because the defect neutralises a control that many operators rely on as their primary protection for a remote-access gateway, it warrants priority remediation regardless of the absence of exploitation telemetry.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved, where a specifically malformed BGP UPDATE sent by an eBGP peer that did not negotiate the four-octet-AS (RFC 6793) capability triggers an out-of-bounds write in the routing protocol daemon (rpd), disrupting or crashing the routing control plane on affected devices. The CVSS 4.0 vector (8.7, AV:N/AC:L/PR:N/UI:N/VA:H/SA:L) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) both characterize this as a pure availability-only flaw with no confidentiality or integrity impact. Although PR:N, exploitation is not reachable by an arbitrary off-path internet host: the attacker must hold (or be able to spoof/inject into) an established eBGP session with the target device, and the device must be running BGP with at least one such eBGP neighbor. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Juniper has released fixed builds.
A malformed SRv6 structure within an EVPN route update can crash the routing protocol daemon (rpd) on Juniper Junos OS and Junos Evolved, causing a denial of service that disrupts routing adjacencies. The vulnerability affects specific versions of Junos OS and Junos Evolved, and exploitation requires the attacker to be a configured EVPN signaling peer with SRv6 enabled; it is not exploitable by arbitrary off-path hosts. While the CVSS 4.0 score is 8.7, the impact is availability-only; no public exploit code has been identified at time of analysis, and the vendor has released patches.
Malformed BGP EVPN NLRI sent to the routing protocol daemon (rpd) crashes rpd on Juniper Networks Junos OS and Junos OS Evolved, disrupting routing on the affected device until the daemon restarts automatically (CVSS 4.0 base 8.7; assessed CVSS 3.1 7.5 with availability-only impact). Only devices that have BGP EVPN configured with an established peering session are reachable: the attacker must act as a configured BGP EVPN peer - a controlled or compromised peer, or an on-path injection into that session - and needs no credentials or user interaction on the target (PR:N/UI:N). Affected releases span multiple Junos OS and Junos OS Evolved branches (23.2 through 26.2), and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available.
The Juniper Junos OS routing process (rpd) can be crashed by a configured BGP-LS peer sending a specially crafted BGP-LS update, resulting in a denial of service. This reachable assertion vulnerability (CWE-617) affects Junos OS and Junos OS Evolved only when BGP-LS is configured and a peering session is established, requiring the attacker to be an already-trusted, configured BGP-LS peer. No public exploit code or active exploitation has been identified at the time of analysis, but the CVSS score of 8.7 reflects the high availability impact.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved: the Layer 2 address learning daemon (l2ald) contains an integer overflow/wraparound (CWE-190) that can be triggered by a crafted EVPN Type-2 (MAC/IP) route advertisement, causing the process to fail and disrupting EVPN-based Layer 2 forwarding. Affected are devices running EVPN with an established, configured BGP peering session; the attacker must control one of those configured EVPN BGP peers, so exposure is limited to environments where EVPN is deployed and peer trust is not strictly enforced. CVSS 8.7 (CVSS 4.0) and 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV). This is a credible operational priority for networks running EVPN, though not a mass-exploitation threat.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved affects the rpd routing process, which can be disrupted when a configured MVPN neighbor sends a crafted BGP MVPN update to a device running a non-default inter-region segmented VRF configured with 'protocols mvpn inter-region-template'. Exposure is narrow but real: the target must have that specialized multicast-VPN configuration and an established BGP MVPN peering relationship with the sender, and the CVSS 4.0 vector is unauthenticated (PR:N) with network reachability. Impact is availability-only (rpd disruption with automatic recovery, no confidentiality or integrity loss), the base score is 8.7 High with a low subsequent-system availability effect (SA:L) indicating a scope-crossing impact on routing, and no public exploit code or confirmed active exploitation is identified at time of analysis.
A NULL pointer dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved crashes the daemon and causes a denial of service when a routing policy that uses AS-path expansion is evaluated against MSDP or PIM data. Exploitation is constrained by non-default configuration: the device must have MSDP or PIM enabled together with an AS-path-expansion policy, and the attacker must either already be a configured MSDP peer or be an adjacent PIM sender able to inject PIM messages. Juniper rates the 4.0 base score at 8.7 with network reach, low complexity, and PR:N per the vector, but the real limiting factors are positional (established peering or adjacency) and configuration-specific rather than arbitrary-internet reachable; impact is availability only, with no data exposure, integrity loss, or code execution, and no public exploit identified at time of analysis.
Malformed BGP labeled-unicast UPDATE messages can crash the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on affected routers (CVSS 8.7). Per the vendor CVSS vector the attack is unauthenticated (PR:N), but exploitation in practice requires two concrete preconditions: the sender must be a configured eBGP neighbor with an established BGP peering session to the target, and the affected BGP multipath features must be enabled on the router, with the trigger arriving as labeled-unicast UPDATEs. Impact is availability only - rpd crashes with no confidentiality or integrity effect - and no public exploit code has been identified at time of analysis, so this is primarily an operational-availability risk for Juniper networks that peer eBGP with external or less-trusted parties and run multipath.
A crafted BGP route update sent by an adjacent eBGP peer can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved devices that have RIB sharding enabled, producing a denial-of-service condition affecting routing availability. Per the independent assessment, exploitation requires two non-trivial preconditions: RIB sharding must be explicitly configured (it is not a default setting), and the attacker must already hold an established eBGP peering session with the target; the assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is unauthenticated but adjacent, with availability-only impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a high-severity but condition-gated DoS rather than a code-execution or data-exposure flaw; devices without RIB sharding or peering only with trusted neighbors are not realistically exposed.
Juniper Networks Junos OS and Junos OS Evolved can have their routing protocol daemon (rpd) crashed by a crafted BGP route update, producing a routing-layer denial of service on devices that combine extended next-hop tunneling with SRv6 service processing. Only deployments with both of these non-default, service-provider-oriented features active are exposed, and the traffic must arrive over an established BGP peering session, so real-world exposure is narrow; the impact is availability-only with no confidentiality or integrity loss. No public exploit code and no CISA KEV entry were identified at time of analysis, and the referenced Juniper advisory (JSA112187) is the authoritative source for affected versions.
Crafted BGP route updates sent by an established BGP peer can trigger an integer overflow in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved, crashing the process and causing a denial of service. The flaw is only reachable when the non-default extended-nexthop-tunnel feature is explicitly enabled on the target device, and the attacker must already hold a configured BGP peering relationship with the device, meaning a trusted routing position is a prerequisite rather than anonymous internet exposure. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor CVSS 4.0 score of 8.7 reflects high availability impact on the local system with no confidentiality or integrity exposure; note that the vendor vector lists PR:N while the vendor's own description and our assessment specify an authenticated BGP peer, a conflict that should be resolved using the description's authentication requirement.
Denial of service in Juniper Networks Junos OS Evolved can be triggered by a crafted SNMP query to the firewall-counter MIB, causing the fwstatsd daemon to hit a reachable assertion and terminate, which disrupts device availability when at least one firewall counter is configured. The advisory describes an authenticated network attacker and the independent assessment's CVSS 3.1 vector (PR:L) reflects an authenticated prerequisite, while the supplied CVSS 4.0 vector lists PR:N, an inconsistency that should be verified against Juniper's advisory. No public exploit code or active exploitation has been identified at time of analysis.
A crafted BGP-LS Link NLRI advertisement sent over an established BGP-LS peering session can trigger a reachable assertion inside the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved, causing rpd to crash and disrupting the device's routing control plane. Impact is limited to availability - no code execution, data disclosure, or integrity impact occurs - and only devices explicitly configured with BGP-LS and peered with the attacker's BGP-LS speaker are exposed, meaning the attacker must occupy or control one of the operator-provisioned BGP-LS peers. This is a credible operational-risk denial-of-service issue rather than a code-execution or data-breach threat; no public exploit code identified at time of analysis, and vendor patches are available per Juniper advisory JSA112187.
Denial of service affecting the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved is triggered when crafted or malformed BGP-LS (BGP Link-State) routing updates hit a reachable assertion in the daemon, causing it to terminate. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the attacker must hold a valid, authenticated BGP peering session with the target and the device must be configured for BGP-LS; devices that do not run BGP-LS, or that peer only with trusted and uncompromised neighbors, are not realistically exposed. Impact is confined to availability of the rpd process with automatic recovery, no confidentiality or integrity impact applies, no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered when the routing protocol daemon (rpd) fails to properly validate a quantity field carried in a BGP MVPN (Multicast VPN) signaling update, allowing the crafted message to disrupt rpd and impair routing on the affected device. Exploitation is constrained by a strong precondition: the target must be configured for BGP MVPN signaling, and the sender must be - or must impersonate - an already configured, established BGP MVPN peer, so exposure is limited to the BGP MVPN peering trust boundary rather than arbitrary internet hosts. Impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 score 8.7), with supplemental metrics indicating automatic recovery; no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, peer-trusted attacker to crash the routing protocol daemon (rpd) by sending specially crafted EVPN route updates. Exploitation requires an established, accepted EVPN BGP peering session with the attacker controlling or compromising the peer endpoint; routers without EVPN/BGP signaling configured or without the attacker in their accepted-peer set are not exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis; risk is limited to availability (no confidentiality or integrity impact), but the flaw is a genuine operational priority for networks running EVPN.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-positioned attacker to disrupt the routing protocol daemon (rpd) by delivering a crafted BGP EVPN update message. Affected releases include multiple Junos OS and Junos OS Evolved versions, but exposure requires that BGP with the EVPN address family be configured - a non-default setting typical of EVPN-VXLAN data center fabrics - and the attacker must be able to reach rpd over an established BGP EVPN session (a configured peer or an on-path attacker on the peering path). Impact is availability-only (control-plane DoS) with no confidentiality or integrity exposure; no public exploit identified at time of analysis, and vendor patches are available.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered in the routing protocol daemon (rpd) by a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. The vendor rates this 8.7, while independent assessment maps it to high availability impact (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss; the practical precondition is an established EVPN peering relationship, so an arbitrary internet host is not sufficient despite the unauthenticated CVSS vector. No public exploit code or CISA KEV active exploitation is identified in the provided data at time of analysis, and affected deployments are those running EVPN on unpatched Junos OS or Junos OS Evolved releases.
Denial of service in Juniper Junos OS and Junos OS Evolved rpd allows a configured BGP neighbor to crash the routing protocol daemon by sending a crafted BGP route update when both resolution-map routing policy and policy event-tracing are enabled. The flaw is a NULL pointer dereference (CWE-476) affecting multiple release trains; exploitation requires the non-default combination of those two features and an existing BGP peering relationship, so baseline or non-peered devices are not exposed. Juniper has released patches via advisory JSA112187, and no public exploit identified at time of analysis.
A NULL pointer dereference in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated, already-configured BGP peer crash the routing process by sending a crafted BGP UPDATE, producing a denial of service, but only on devices where both ISO-VPN and egress-protection are enabled - a non-default feature combination. The CVSS 4.0 vector scores 8.7 (High) and is driven entirely by availability impact (VC:N/VI:N/VA:H/SC:N/SI:N/SA:L), with no confidentiality or integrity loss. No public exploit code and no confirmed active exploitation were identified at time of analysis; arbitrary Internet hosts cannot reach the vulnerable code path because the sender must already be an operator-configured BGP peer of the target device.
A NULL pointer dereference in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved lets a configured BGP peer crash the routing process by sending a BGP UPDATE when an import policy using `then source-based-forwarding next-hop next-table <X>` points at a routing table that does not exist. Exploitation is unauthenticated per the CVSS vector (PR:N) and network-reachable (AV:N), but it requires two non-default preconditions: the specific source-based-forwarding import policy misconfiguration, and an established, operator-sanctioned BGP peering session - both of which materially narrow real-world exposure. There is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); impact is availability-only, with a daemon crash that can ripple into network reachability.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved (rpd) allows a configured BGP peer to crash or disrupt the routing protocol daemon by sending a specifically malformed BGP MCAST-TREE update that is then attempted to be re-advertised. The vulnerability affects numerous Junos OS and Junos OS Evolved versions below the fixed releases listed in Juniper advisory JSA112187, with a CVSS v4.0 score of 8.7. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires the attacker to be an established BGP peer and the target to participate in BGP multicast routing.
A malformed BGP-signaled SRv6 service route can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service that disrupts routing on the affected device. The issue is remotely triggerable with no credentials or user interaction (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N, VA:H), scoring 8.7, but it is conditional: exploitation requires that SRv6 dynamic tunnels be explicitly enabled (a non-default configuration) and that the attacker already hold an established BGP peering session with the target. Impact is limited to availability of the routing daemon - there is no confidentiality or integrity impact - and no public exploit has been identified at time of analysis. All software versions enumerated by the vendor are unpatched; Juniper has released fixed builds.
A crafted BGP FlowSpec update delivered over an established peering session crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking the device's control plane and routing functionality offline until rpd recovers. Affected release trains include Junos OS before 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2, plus the corresponding Junos OS Evolved builds and the Evolved 23.4X100, 25.2X100 and 25.4X300 trains. The mechanics of the trigger are simple and require no credentials beyond a BGP session that carries the FlowSpec address family, but exploitation is gated by that peering prerequisite; there is no public exploit code identified at time of analysis and no confirmed active exploitation, and Juniper has published fixed builds under advisory JSA112187.
Persistent routing-daemon denial of service affects Juniper Networks Junos OS and Junos OS Evolved: a single specially crafted BGP packet crashes rpd (NULL pointer dereference, CWE-476) when the device is running with ephemeral configuration in use, and the targeted router must already have the sending device established as an eBGP peer. The CVSS 4.0 base score is 8.7 with PR:N, i.e. no authentication is required from the network perspective, but exploitation is bounded by two real prerequisites - an existing BGP peering/trust relationship and the ephemeral-configuration feature being active - so routers that do not peer with the attacker or that do not use ephemeral configuration are not exposed. Impact is availability only (rpd restart/crash cycle with no confidentiality or integrity loss); there is no public exploit identified at time of analysis, and CISA KEV does not list this issue. A vendor fix is available.
Unauthenticated remote attackers can bypass access controls in the TSplus Remote Access web server via manipulated paths on the /socket.io/JWN/ endpoint, leading to disclosure of protected internal resources. This high-severity vulnerability (CVSS 4.0 base 8.7) affects internet-exposed portals with no authentication or user interaction required. No public exploit identified at time of analysis, but the flaw is trivially exploitable given network reachability.
A stack-based buffer overflow in the authd authentication daemon of Juniper Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service when both SNMP and AAA are enabled. Exploitation requires valid SNMP read credentials (low-privileged, authenticated) and the specific SNMP+AAA configuration, but no user interaction, making it a credible high-priority risk for devices with exposed SNMP management. Vendor patches are available; no public exploit was identified at time of analysis.
A crafted VPN-flowspec BGP update can crash the routing protocol daemon (rpd) on Juniper Junos OS and Junos OS Evolved, causing a denial of service, but only when that update is readvertised by the device and BMP post-policy RIB-out monitoring is explicitly configured. The flaw is a NULL pointer dereference (CWE-476) reachable by a remote BGP peer that already has an established peering session with the target (PR:N means no device-level authentication is required, but a configured neighbor relationship is a practical prerequisite). The vendor rates it 8.7 under CVSS 4.0 while our independent assessment scores it 7.5 under CVSS 3.1 (AC:H), reflecting the non-default BMP configuration and readvertisement conditions; impact is availability-only with no confidentiality or integrity effect, and no public exploit code has been identified at time of analysis.
Denial of service in Juniper Junos OS and Junos OS Evolved can be triggered by a remote BGP EVPN neighbor when SRv6 EVPN multihoming is configured, causing the routing protocol daemon (rpd) to crash. The issue affects specific Junos OS trains (25.2, 25.4, 26.2) and Junos OS Evolved trains (23.4X100, 25.2, 25.2X100, 25.4, 25.4X300, 26.2) below their fixed service releases. No public exploit identified at time of analysis, and exploitation is gated by the non-default SRv6 EVPN multihoming configuration plus an established BGP EVPN peering relationship.
A heap-based buffer overflow in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows an attacker who controls (or has compromised) the SDN controller to crash the OVSDB control plane - a complete denial of service of the EVPN/VXLAN control path - and possibly achieve remote code execution on the gateway device. The flaw is remotely reachable from the adjacent control/management network (CVSS 4.0 8.7, AV:A/PR:N), meaning no authentication is required per the published vector, though exploitation is conditional: the device must be deployed as a VXLAN/EVPN gateway with the OVSDB control plane enabled and managed by an external SDN controller, which is not a default configuration. Vendor patches are available and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated arbitrary file read in Gitingest 0.3.1 and earlier allows remote attackers to retrieve any file readable by the service account, in chunks capped at 10 MB per request, by committing a symbolic link into a public repository and submitting that symlink's blob URL to the single-file ingestion path in ingest_query. The server resolves the link and returns the target file's contents instead of confining reads to in-repo content, so a network-reachable instance that accepts untrusted repository or blob URLs - the default mode for both the hosted service and self-hosted deployments - is directly exposed with no credentials or user interaction required. There is no CISA KEV listing and no public exploit identified at time of analysis, though a public technical writeup describing the symlink technique accompanies the VulnCheck advisory; impact is bounded by the service account's file permissions and the 10 MB per-request cap.
Unauthenticated, remote attackers can bypass authentication and reach protected paths in F5 NGINX Kubernetes Ingress Controller (NIC) deployments configured with the ExternalAuth policy or Ingress external authentication. The flaw (CWE-290, authentication bypass by spoofing) occurs because client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers are forwarded unsanitized into the internal NGINX auth_request subrequest, letting an attacker spoof the request attributes the external authentication provider evaluates; exploitation is remote, low-complexity and requires no authentication or user interaction, but is gated on the non-default external-auth configuration and is bounded to the data plane, affecting confidentiality/access only (no control plane exposure, no integrity or availability impact). No public exploit identified at time of analysis.
Denial of service affecting Juniper Networks Junos OS and Junos OS Evolved: an unauthenticated remote attacker who can deliver a specifically malformed BGP EVPN multicast update to a device configured for EVPN multicast can crash the routing protocol daemon (rpd) when that update is processed for readvertisement, taking down routing on the affected box. Per the vendor's CVSS 4.0 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), the impact is availability-only, but exposure is bounded by a real prerequisite: the target must run EVPN multicast (e.g. EVPN handling of IGMP/MLD / SMET multicast routes) with a live BGP session, and the attacker needs a peering relationship or on-path injection capability for the update to arrive and be readvertised. Vendor-released patches are available and no public exploit code has been identified at time of analysis, so this is a genuine but bounded operational risk.
Authenticated SQL injection in Tenable Nessus lets any user with a valid low-privilege Nessus account read or modify data stored by the scanner through the web interface or API, affecting every instance running a version below 10.12.5. The flaw is rated CVSS v4.0 8.7 and maps to CWE-89; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Tenable has shipped a vendor patch in Nessus 10.12.5, and the issue is best treated as a credible, elevated-priority finding rather than an emergency, because exploitation requires pre-existing credentials plus network reachability to the Nessus interface.
Sustained high connections-per-second churn can drive a per-session memory leak in the packet forwarding engine (PFE) of Juniper Junos OS, exhausting PFE memory and causing a complete denial of service on SRX4000 Series, SRX5000 Series with SPC3, and MX Series with SPC3. The flaw is reachable by unauthenticated, network-based remote attackers (CVSS vector includes PR:N/UI:N, so no credentials or user interaction are required), but only on devices where at least one application service such as ALGs, IDP/DPI, APPID, SECINTEL, AAMW, or AppQoE is actually configured. Affected releases are 23.4 from 23.4R2-S3 before 23.4R2-S7, 24.2 from 24.2R2 before 24.2R2-S3, 24.4 before 24.4R2-S3, and 25.2 before 25.2R1-S2/25.2R2; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).
Denial of service in Juniper Networks Junos OS and Junos OS Evolved: a malformed BGP ISO-VPN (CLNS/IS-IS L3VPN) update from an accepted ISO-VPN peer crashes the routing protocol daemon (rpd) when that update is subsequently handled by BMP route monitoring or by NSR replication, taking down routing on the affected device (CVSS 4.0 base 8.7; AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and SA:L). Exploitation requires no credentials on the wire, but it is gated by a pre-established BGP ISO-VPN peering relationship, so realistic exposure is limited to compromised or malicious peers rather than arbitrary internet hosts, and the device must additionally have BMP route monitoring or NSR enabled. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; exploitation yields only availability impact, with no confidentiality or integrity loss on the router itself.
A specific BGP packet sent by an existing eBGP peer can trigger a NULL pointer dereference in the routing-policy nexthop-ECMP matcher of Juniper Junos OS and Junos OS Evolved, killing the routing daemon and causing a denial of service (CVSS 4.0 base 8.7; independent assessment scores it AV:N/AC:H/PR:N/UI:N/A:H with no confidentiality or integrity impact). Exploitation is gated by two preconditions: the device must have a nexthop-ecmp qualifier attached to a BGP import policy - an explicitly deployed, non-default routing-policy configuration - and the sender must already be a configured eBGP peer, so an arbitrary unauthenticated Internet host cannot reach the flaw; the CVSS vectors carry PR:N, but reachability still requires an established BGP peering session. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor fixes are available per Juniper advisory JSA112187.
A crafted BGP Prefix-SID (Segment Routing) route that is received and then re-advertised by the rpd routing daemon triggers a numeric truncation error in Juniper Junos OS and Junos OS Evolved 20.4R1 / 20.4R1-EVO and later, letting an unauthenticated network-based attacker cause a denial of service against the affected device. Exposure is limited to devices that actually run BGP with Prefix-SID in use, and the malformed route must be accepted into the BGP control plane and re-advertised, which in realistic deployments implies a BGP adjacency or an upstream/route-injection position rather than arbitrary off-path Internet access. No public exploit identified at time of analysis and no CISA KEV listing; the vendor has published fixed maintenance releases covered by advisory JSA112187, so exposure is a patch-management problem rather than an active campaign.
A remote, unauthenticated attacker can cause a denial of service in the routing protocol daemon (rpd) of Juniper Junos OS and Junos OS Evolved by sending crafted EVPN multihoming traffic when the device is configured with preference-based designated-forwarder election. The flaw, an infinite loop (CWE-835), halts the routing daemon and affects only availability, with no confidentiality or integrity impact. Exploitation requires the non-default EVPN multihoming feature to be enabled; a vendor patch (JSA112187) is available, and no public exploit has been identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to crash the routing protocol daemon (rpd) via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Exploitation requires two non-default preconditions: an established EVPN peering session and an active telemetry sensor subscription; the impact is availability-only (rpd crash) with automatic recovery after daemon restart and reconvergence. No public exploit identified at time of analysis; vendor patch available (see Juniper advisory JSA112187).
Crashing the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved is possible via a malformed BGP MCAST-VPN update sent from a configured eBGP peer, resulting in a denial-of-service condition. Exploitation is gated: the target must have the BGP multicast-VPN (MVPN) address family active and an established eBGP peering relationship, so realistic attackers are limited to peering or adjacent networks rather than the general internet. No public exploit code or confirmed active exploitation exists at time of analysis, and the vendor advisory (JSA112187) should be consulted for patch availability.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved rpd allows an attacker with access to a configured BGP peering session to crash the routing protocol daemon by sending a crafted BGP route attribute that is processed while a BGP RIB streaming telemetry subscription is active. Affected are Junos OS and Junos OS Evolved versions 22.1R1 and later (22.1R1-EVO for Evolved); earlier releases are not vulnerable. Exploitation is conditional on both the BGP peer relationship and a non-default telemetry subscription, making this a conditional availability risk rather than a top-tier emergency; no public exploit identified at time of analysis, and vendor patches are available.
Stack-based buffer overflow in Juniper Networks Junos OS jdhcpd lets an unauthenticated adjacent attacker crash the DHCP client process with a crafted DHCP response, causing denial of service for DHCP, relay, and zero-touch-provisioning services on devices configured as DHCP clients. Exploitation requires L2 adjacency to the victim and no authentication or user interaction; devices not operating as DHCP clients are not exposed, and service recovers once malicious traffic stops. Vendor patches are available per Juniper advisory JSA112188, and no public exploit code has been identified at time of analysis.
Authentication bypass in F5 NGINX Ingress Controller allows unauthenticated remote attackers to access protected paths when an externalAuth policy delegating to an OAuth identity provider is configured. The flaw is due to incorrect handling of the IdP's HTTP response (CWE-303), enabling access before proper authentication completes. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), it requires no privileges or user interaction, impacts confidentiality only, and is strictly a data plane issue with no control plane exposure. No public exploit has been identified at time of analysis; only deployments using externalAuth with OAuth are affected.
A NULL pointer dereference in the pkid (PKI daemon) component of Juniper Networks Junos OS can be triggered by a malformed packet delivered during CMP (Certificate Management Protocol) enrollment or automatic certificate re-enrollment, causing the affected daemon to crash and producing a denial-of-service condition. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and affects numerous Junos OS trains including 23.2, 23.4, 24.2, 24.4, 25.2, 25.4, and 26.2 below their respective fixed maintenance releases; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is conditional on the target device actually being in a CMP enrollment or re-enrollment exchange at the time the malformed packet arrives, so devices not configured for CMP-based certificate provisioning are not exposed via this vector, and no public exploit code was identified at time of analysis.
Stack-based buffer overflow in the srxpfe packet-forwarding daemon of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series lets a Layer-2-adjacent attacker execute arbitrary code as root by injecting crafted high-availability fabric traffic. This is a genuinely serious but access-constrained vulnerability: exploitation requires the SRX to be operating in a high-availability chassis cluster, and the attacker must already sit on the same Layer-2 segment as the HA fabric link - the flaw is not reachable over routed networks and does not affect standalone or non-clustered deployments. No authentication or user interaction is required once fabric adjacency is achieved (PR:N/UI:N per the assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector and the vendor CVSS 4.0 score of 8.7), and no public exploit code has been identified at time of analysis; the vendor reports a patch is available via advisory JSA112186.
Heap-based buffer overflow in the secure-dot1xd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service by sending a crafted EAPOL frame to an 802.1X-authenticated interface. Exploitation requires the targeted interface to be configured for 802.1X port-based authentication and Layer 2 adjacency, and no public exploit has been identified at time of analysis. With a CVSS 4.0 score of 8.7, this is a high-priority flaw for affected deployments using 802.1X.