EUVD-2026-42699
GHSA-978v-9chj-92p2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Green
Network-reachable and unauthenticated (AV:N/PR:N) but the trigger depends on events outside attacker control, so AC:H; impact is availability-only (A:H) with no confidentiality or integrity effect.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
2DescriptionCVE.org
An Improper Check for Unusual or Exceptional Conditions vulnerability in the
advanced forwarding toolkit (evo-aftmand)
of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated network-based attacker generating continuous routing updates, resulting in unilist ECMP routes, to crash the
evo-aftmand process on the PFE, leading to a Denial-of-Service (DoS). The conditions required for successful exploitation are based on a sequence of events that are outside an attacker's direct control.
Unified list (unilist) ECMP routes are a specific ECMP behavior where multiple equal-cost routes share a single logical next-hop list entry. The router treats them as one route with multiple next hops and load balances traffic across that unified list. Due to an issue processing unilist ECMP routing updates, internal state corruption may occur, especially in large-scale ECMP unilist deployments, leading to the evo-aftmand process crashing, resulting in an evo-aftmand-bx core. Manual intervention is required to recover by rebooting the system or restarting the FPC.
This issue affects Junos OS Evolved on PTX :
- from 24.4R2-EVO before 24.4R2-S3-EVO;
- from 25.2 before 25.2R2-EVO.
Articles & Coverage 2
AnalysisAI
Denial-of-service in Juniper Junos OS Evolved on PTX Series routers lets an unauthenticated network attacker crash the advanced forwarding toolkit process (evo-aftmand) on the Packet Forwarding Engine by driving continuous routing updates that produce unified-list (unilist) ECMP routes. The resulting internal state corruption generates an evo-aftmand-bx core and halts forwarding, requiring a manual FPC restart or system reboot to recover. No public exploit identified at time of analysis; the vendor (Juniper SIRT) notes successful exploitation depends on a sequence of events outside the attacker's direct control, so this is a high-CVSS availability issue rather than a trivially reproducible one.
Technical ContextAI
The affected component is evo-aftmand, the advanced forwarding toolkit manager daemon that programs forwarding state onto the PFE in Junos OS Evolved (Juniper's Linux-based, disaggregated network OS running on PTX Series service-provider core routers). The root cause is CWE-754 (Improper Check for Unusual or Exceptional Conditions): while processing ECMP routing updates that resolve into unilist next-hop structures - where multiple equal-cost paths are collapsed into a single logical next-hop list entry for load balancing - the code fails to correctly handle an exceptional/large-scale condition, corrupting internal state. Because unilist consolidation is exercised most heavily in large-scale ECMP deployments, the defect surfaces there, and the crash of a PFE-resident daemon translates directly into a forwarding/availability outage on that FPC.
RemediationAI
Vendor-released patch: upgrade to Junos OS Evolved 24.4R2-S3-EVO or later on the 24.4 train, or 25.2R2-EVO or later on the 25.2 train, per Juniper advisory JSA110073 (https://supportportal.juniper.net/JSA110073). No workaround is documented in the provided data; because the trigger is malformed/exceptional unilist ECMP update processing rather than a specific toggleable feature, compensating controls should focus on limiting who can inject routing updates - restrict and authenticate routing-protocol adjacencies (e.g., BGP/IGP peer filtering, authentication, and prefix limits), apply control-plane protection/loopback filters to accept routing sessions only from trusted peers, and constrain the scale/churn of ECMP paths where feasible. These controls reduce exposure of the PFE forwarding daemon to attacker-influenced updates but do not remove the underlying defect; the trade-off is added routing configuration complexity and potential impact on legitimate dynamic peering. If a crash occurs, recovery requires manually rebooting the system or restarting the affected FPC.
More in Junos Os Evolved
View allAn Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an
An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allow
An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protoc
A Missing Release of File Descriptor or Handle after Effective Lifetime vulnerability in plugable authentication module
An Unchecked Return Value vulnerability in the user interfaces to the Juniper Networks Junos OS and Junos OS Evolved, th
An OS Command Injection vulnerability in gRPC Network Operations Interface (gNOI) server module of Juniper Networks Juno
An Execution with Unnecessary Privileges vulnerability in Management Daemon (mgd) of Juniper Networks Junos OS Evolved a
An Out Of Bounds (OOB) access vulnerability in the handling of responses by a Juniper Agile License (JAL) Client in Juni
An Improper Privilege Management vulnerability in the gRPC framework, used by the Juniper Extension Toolkit (JET) API on
An improper input validation vulnerability in the Routing Protocol Daemon (RPD) service of Juniper Networks Junos OS all
A Buffer Access with Incorrect Length Value vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos
An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today