What is the CVSS score of EUVD-2026-101429?

EUVD-2026-101429 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:H/SI:N/SA:L. EPSS exploitation probability: 0.7%.

How to fix or mitigate EUVD-2026-101429?

Within 24 hours, inventory every Junos OS Evolved device and identify which ones have key-chain authentication configured for BGP or LDP, then reduce exposure by restricting TCP/179 and TCP/646 to known BGP and LDP peers through firewall filters or ACLs and by removing key-chain authentication from any BGP or LDP session that does not strictly require it; begin monitoring for kernel panics and unexpected session resets. Within 7 days, open a case with Juniper support to obtain the fix timeline, apply the vendor-released patch as soon as Juniper publishes a corrected Junos OS Evolved version (no fixed version is identified at time of analysis), and for devices that cannot be patched or reconfigured, isolate the control plane by filtering BGP and LDP protocol traffic at the network perimeter and enforcing rate limiting on those ports. Within 30 days, re-scan configurations to confirm no residual key-chain use on BGP or LDP, verify patched or mitigated status across the entire estate, and update incident response and network recovery runbooks to address a control-plane crash of BGP or LDP routers.

Junos OS Evolved EUVD-2026-101429

Q: Which versions of Junos OS Evolved are affected by EUVD-2026-101429?

Juniper Networks Junos OS Evolved is affected by a remotely triggerable kernel buffer overflow that can crash devices running BGP or LDP sessions configured with key-chain authentication, resulting…. A patch is available.

| CVE-2026-102068 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-10-14 juniper

GHSA-74c5-qgfm-w9w6

Buffer Overflow Stack Overflow Juniper Junos Os Evolved Juniper Networks

9.2

CVSS 4.0 · Vendor: juniper

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach BGP/LDP TCP port on router
Delivery

Send crafted TCP packet
Exploit

Overflow kernel stack buffer in key-chain auth
Execution

Trigger kernel panic
Impact

Router crash and traffic disruption

Vulnerability Assessment

Weakness	CWE CWE-121 ASVS 5.0 V15 - Secure Coding and Architecture Stack buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitable only when the Junos OS Evolved device is configured to use key-chain (authentication-key-chain / TCP-AO or MD5) authentication for a BGP or LDP session; devices without key-chain authentication on these protocols are not affected. The attacker must have network path and reachability to the router's BGP (TCP/179) or LDP (TCP/646) listener. No attacker credentials or user interaction are required (PR:N/UI:N), but the operator-side key-chain configuration is a hard prerequisite that substantially narrows the exposed population. Impact is limited to denial of service (kernel panic / router crash) - there is no confidentiality or integrity impact.
Impact	This is a credible, high-priority denial-of-service issue but NOT a code-execution threat. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation, and the impact metrics are availability-only (VC:N/VI:N/VA:H with subsequent-system SC:H/SA:L), consistent with the description of a kernel panic rather than confidentiality or integrity loss - the 9.2 'Critical' rating is driven almost entirely by availability and the cascading routing impact of taking a core router kernel down. The key mitigating signal is the precondition: the device must have key-chain (TCP authentication) configured for BGP or LDP, so this is NOT universally exploitable against default configurations. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation; treat the network-vector/low-complexity combination as the main reason to patch promptly on affected routers running the vulnerable configuration, while recognizing real-world exposure is gated by whether key-chain auth is deployed. One note for verification: the vector lists PR:N (unauthenticated attacker) yet exploitation depends on an operator-side configuration (key-chain auth enabled) - this is a target prerequisite, not an attacker authentication requirement, and the two should not be conflated.
Exploit ScenarioDerived	An attacker with network reachability to a Junos OS Evolved router that has key-chain authentication enabled for BGP (TCP/179) or LDP (TCP/646) sends a specially crafted TCP packet to that service port. The malformed packet triggers a stack-based buffer overflow in the kernel's authentication handling, causing a kernel panic that reboots or hangs the router and disrupts traffic. No exploit code is publicly identified at time of analysis, and exploitation requires no credentials but does require the vulnerable key-chain configuration to be present.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.7% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Oct 14, 2026

A stack-based buffer overflow in the kernel of Juniper Networks Junos OS Evolved can be triggered by a crafted TCP packet when key-chain authentication is configured for BGP or LDP sessions, leading to a kernel panic and denial of service. This remotely exploitable, unauthenticated vulnerability requires network reachability to BGP (TCP/179) or LDP (TCP/646) and the operator-side configuration of key-chain authentication for those protocols. No public exploit code or active exploitation has been identified at time of analysis; the assessed impact is limited to denial of service with no confidentiality or integrity impact, and it is not a code-execution threat.

Earlier versions of this analysis (1)

v1 Oct 14, 2026 - 16:40 CVSS 7.5

A crafted TCP packet can crash the kernel of Juniper Networks Junos OS Evolved when key-chain (TCP) authentication is configured for BGP or LDP, giving a remote, unauthenticated attacker a denial-of-service condition scored CVSS:3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The flaw is a stack-based buffer overflow (CWE-121) in kernel code that processes authenticated TCP segments, so the availability impact is a full kernel panic rather than data disclosure or modification. Attackers only need IP reachability to a BGP/LDP listener that has key-chain authentication enabled - a non-default configuration - and no public exploit code has been identified at time of analysis (no KEV listing; no EPSS value supplied).

RemediationAI

Apply the vendor-released patch as specified in Juniper Security Advisory JSA112250 (https://supportportal.juniper.net/JSA112250). The advisory lists the fixed Junos OS Evolved versions; upgrade to the appropriate fixed release. If immediate patching is not possible, consider disabling key-chain authentication for BGP and LDP sessions if operationally feasible, as this removes the vulnerable code path. However, disabling authentication reduces session security and may expose BGP/LDP to other attacks. Alternatively, restrict access to BGP (TCP/179) and LDP (TCP/646) ports to trusted peers using firewall filters or ACLs, but this may not fully mitigate if the attacker can spoof trusted addresses or if a trusted peer is compromised. Monitor for kernel panics and unusual BGP/LDP traffic. The primary and most reliable remediation is to install the vendor patch; workarounds are temporary and carry trade-offs.

Affected VersionsENISA

Junos OS Evolved 25.4X300 <25.4X300-D40-EVO

Junos OS Evolved 24.2 <24.2R2-S5.6-EVO

Junos OS Evolved 26.2 <26.2R1-S2-EVO

Junos OS Evolved 25.2X100 <25.2X100-D35-EVO

Junos OS Evolved 23.4 <23.4R2-S8.11-EVO

Junos OS Evolved 25.4 <25.4R1-S3-EVO

Junos OS Evolved 25.2 <25.2R2-S2-EVO

Junos OS Evolved 23.4X100

Junos OS Evolved 0 <23.2R2-S7.7-EVO

Junos OS Evolved 24.4 <24.4R2-S5-EVO

Affected Packages

euvd junos_os_evolved fix: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is a stack-based buffer overflow (CWE-121) in the kernel's handling of TCP packets for BGP or LDP when key-chain authentication is configured. The overflow occurs when a crafted packet is processed, corrupting the stack and causing a kernel panic. While buffer overflows can sometimes lead to code execution, the independent assessment confirms that the impact here is limited to denial of service, with no confidentiality or integrity impact. The CPE string cpe:2.3:a:juniper_networks:junos_os_evolved:*:*:*:*:*:*:*:* indicates that all versions of Junos OS Evolved may be affected, though specific fixed versions are detailed in the vendor advisory. Key-chain authentication for BGP (TCP/179) and LDP (TCP/646) is a hard prerequisite; devices without this configuration are not exposed.

Know when Junos Os Evolved gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (juniper) PRIMARY 9.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:H/SI:N/SA:L

vuln.today AI 7.5 HIGH

Remote unauthenticated crafted-packet trigger (AV:N/AC:L/PR:N/UI:N); kernel panic is availability-only (A:H, C:N/I:N); scope kept unchanged as the crashing component is the device's own kernel.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (juniper).

CVSS VectorVendor: juniper

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

High

Subsequent system: Integrity

None

Subsequent system: Availability

Low

Lifecycle Timeline

Patch available

Oct 14, 2026 - 18:05 EUVD

Severity Changed

Oct 14, 2026 - 17:22 NVD

HIGH CRITICAL

CVSS changed

Oct 14, 2026 - 17:22 NVD

7.5 (HIGH) 9.2 (CRITICAL)

CVE Published

Oct 14, 2026 - 16:14 cve.org

HIGH 7.5

DescriptionCVE.org

A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP.

Executive ViewAI

Why It Matters

Juniper Networks Junos OS Evolved is affected by a remotely triggerable kernel buffer overflow that can crash devices running BGP or LDP sessions configured with key-chain authentication, resulting in a denial of service. Organizations using Junos OS Evolved at the WAN edge, core, or in service-provider-facing roles could experience dropped routing sessions and network outages until affected devices recover. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to availability with no expected loss of confidentiality or integrity.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability to BGP (TCP/179) and LDP (TCP/646) to trusted peers via firewall filters or ACLs; remove key-chain authentication from BGP or LDP sessions where not operationally required or substitute an alternative authentication method; apply control-plane policing and rate limiting on those ports; monitor for kernel panics and unexpected session resets.

Threat Intelligence Overview

EPSS Score

0.7%

Top 46% exploitable

Prevalence

Medium

Carrier/enterprise Juniper routing OS, significant but narrower than general Junos footprint

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.7%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.