What is the CVSS score of CVE-2026-21911?

CVE-2026-21911 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Junos Os Evolved are affected by CVE-2026-21911?

CVE-2026-21911 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-21911?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Junos Os Evolved CVE-2026-21911

MEDIUM

Incorrect Calculation (CWE-682)

2026-01-15 sirt@juniper.net

Juniper Junos Os Evolved

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 15, 2026 - 21:16 nvd

MEDIUM 6.5

DescriptionCVE.org

An Incorrect Calculation vulnerability in the Layer 2 Control

Protocol

Daemon (l2cpd) of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker flapping the management interface to cause the learning of new MACs over label-switched interfaces (LSI) to stop while generating a flood of logs, resulting in high CPU usage.

When the issue is seen, the following log message will be generated:

op:1 flag:0x6 mac:xx:xx:xx:xx:xx:xx bd:2 ifl:13302 reason:0(REASON_NONE) i-op:6(INTRNL_OP_HW_FORCE_DELETE) status:10 lstatus:10 err:26(GETIFBD_VALIDATE_FAILED) err-reason 4(IFBD_VALIDATE_FAIL_EPOCH_MISMATCH) hw_wr:0x4 ctxsync:0 fwdsync:0 rtt-id:51 p_ifl:0 fwd_nh:0 svlbnh:0 event:- smask:0x100000000 dmask:0x0 mplsmask 0x1 act:0x5800 extf:0x0 pfe-id 0 hw-notif-ifl 13302 programmed-ifl 4294967295 pseudo-vtep underlay-ifl-idx 0 stack:GET_MAC, ALLOCATE_MAC, GET_IFL, GET_IFF, GET_IFBD, STOP,

This issue affects Junos OS Evolved:

all versions before 21.4R3-S7-EVO,
from 22.2 before 22.2R3-S4-EVO,
from 22.3 before 22.3R3-S3-EVO,
from 22.4 before 22.4R3-S2-EVO,
from 23.2 before 23.2R2-S1-EVO,
from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO.

AnalysisAI

MAC learning failures in Juniper Junos OS Evolved's Layer 2 Control Protocol Daemon can be triggered by a network-adjacent attacker who repeatedly toggles the management interface, causing label-switched interface MAC address learning to halt while generating excessive logs and consuming high CPU resources. This calculation error (CWE-682) affects availability through denial of service and currently has no available patch. The attack requires network adjacency but no authentication or user interaction.

Technical ContextAI

Affects Junos Os Evolved. An Incorrect Calculation vulnerability in the Layer 2 Control

Protocol

When the issue is seen, the following log message will be generated:

op:1 flag:0x6 mac:xx:xx:xx:xx:xx:xx bd:2 ifl:13302 reason:0(REASON_NONE) i

RemediationAI

Monitor vendor advisories for a patch.

More in Junos Os Evolved

View all

CVE-2021-31353 HIGH This Week POC

7.5 Oct 19

An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an

CVE-2024-39553 MEDIUM This Month POC

6.9 Jul 11

An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allow

CVE-2021-0211 CRITICAL Act Now

10.0 Jan 15

An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protoc

CVE-2022-22215 MEDIUM This Month POC

5.5 Jul 20

A Missing Release of File Descriptor or Handle after Effective Lifetime vulnerability in plugable authentication module

CVE-2023-44182 HIGH This Week

8.8 Oct 13

An Unchecked Return Value vulnerability in the user interfaces to the Juniper Networks Junos OS and Junos OS Evolved, th

CVE-2023-28983 HIGH This Week

8.8 Apr 17

An OS Command Injection vulnerability in gRPC Network Operations Interface (gNOI) server module of Juniper Networks Juno

CVE-2022-22239 HIGH This Week

8.8 Oct 18

An Execution with Unnecessary Privileges vulnerability in Management Daemon (mgd) of Juniper Networks Junos OS Evolved a

CVE-2021-31354 HIGH This Week

8.8 Oct 19

An Out Of Bounds (OOB) access vulnerability in the handling of responses by a Juniper Agile License (JAL) Client in Juni

CVE-2021-31350 HIGH This Week

8.8 Oct 19

An Improper Privilege Management vulnerability in the gRPC framework, used by the Juniper Extension Toolkit (JET) API on

CVE-2021-0208 HIGH This Week

8.8 Jan 15

An improper input validation vulnerability in the Routing Protocol Daemon (RPD) service of Juniper Networks Junos OS all

CVE-2025-30651 HIGH This Week

8.7 Apr 09

A Buffer Access with Incorrect Length Value vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos

CVE-2024-47502 HIGH This Week

8.7 Oct 11

An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved

Same weakness CWE-682 – Incorrect Calculation

View all

CVE-2021-44847 CRITICAL POC

9.8

CVE-2022-23066 CRITICAL POC

9.1

CVE-2022-28048 HIGH POC

8.8

CVE-2020-0022 HIGH POC

8.8

CVE-2019-16346 HIGH POC

8.8

CVE-2023-42460 HIGH POC

7.5

CVE-2022-22138 HIGH POC

7.5

CVE-2022-30780 HIGH POC

7.5

CVE-2026-21911 vulnerability details – vuln.today

Back

Junos Os Evolved CVE-2026-21911

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Junos Os Evolved

Same weakness CWE-682 – Incorrect Calculation

Share

External POC / Exploit Code