Juniper
Monthly
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Junos OS Evolved devices through the J-Web management interface when web management is enabled, due to improper authentication in NETCONF session handling. This is a critical vulnerability (CVSS 9.3/9.8) that requires only network reachability to the J-Web HTTP/HTTPS service; no credentials or user interaction are needed. No public exploit code or active exploitation has been identified at time of analysis, but the risk is genuine and high-priority as noted in independent assessment, not merely a high-CVSS artifact.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved: a malformed BGP ISO-VPN (CLNS/IS-IS L3VPN) update from an accepted ISO-VPN peer crashes the routing protocol daemon (rpd) when that update is subsequently handled by BMP route monitoring or by NSR replication, taking down routing on the affected device (CVSS 4.0 base 8.7; AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and SA:L). Exploitation requires no credentials on the wire, but it is gated by a pre-established BGP ISO-VPN peering relationship, so realistic exposure is limited to compromised or malicious peers rather than arbitrary internet hosts, and the device must additionally have BMP route monitoring or NSR enabled. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; exploitation yields only availability impact, with no confidentiality or integrity loss on the router itself.
A crafted VPN-flowspec BGP update can crash the routing protocol daemon (rpd) on Juniper Junos OS and Junos OS Evolved, causing a denial of service, but only when that update is readvertised by the device and BMP post-policy RIB-out monitoring is explicitly configured. The flaw is a NULL pointer dereference (CWE-476) reachable by a remote BGP peer that already has an established peering session with the target (PR:N means no device-level authentication is required, but a configured neighbor relationship is a practical prerequisite). The vendor rates it 8.7 under CVSS 4.0 while our independent assessment scores it 7.5 under CVSS 3.1 (AC:H), reflecting the non-default BMP configuration and readvertisement conditions; impact is availability-only with no confidentiality or integrity effect, and no public exploit code has been identified at time of analysis.
Adjacent attackers can crash the Juniper Networks Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted LDP packet into an already-established LDP session, causing a denial of service on the affected router. Only devices running MPLS with LDP enabled and an active LDP peering session are exposed, and the attacker must already hold a position on the adjacent network capable of injecting packets into that session (CVSS 3.1 AV:A/AC:L/PR:N/UI:N with availability-only impact; vendor CVSS 4.0 base 7.1). There is no confidentiality or integrity impact - the outcome is loss of rpd availability, though repeated crashes can degrade routing stability; no public exploit has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).
Denial of service in Juniper Junos OS and Junos OS Evolved can be triggered by a remote BGP EVPN neighbor when SRv6 EVPN multihoming is configured, causing the routing protocol daemon (rpd) to crash. The issue affects specific Junos OS trains (25.2, 25.4, 26.2) and Junos OS Evolved trains (23.4X100, 25.2, 25.2X100, 25.4, 25.4X300, 26.2) below their fixed service releases. No public exploit identified at time of analysis, and exploitation is gated by the non-default SRv6 EVPN multihoming configuration plus an established BGP EVPN peering relationship.
Denial of service affecting Juniper Networks Junos OS and Junos OS Evolved: an unauthenticated remote attacker who can deliver a specifically malformed BGP EVPN multicast update to a device configured for EVPN multicast can crash the routing protocol daemon (rpd) when that update is processed for readvertisement, taking down routing on the affected box. Per the vendor's CVSS 4.0 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), the impact is availability-only, but exposure is bounded by a real prerequisite: the target must run EVPN multicast (e.g. EVPN handling of IGMP/MLD / SMET multicast routes) with a live BGP session, and the attacker needs a peering relationship or on-path injection capability for the update to arrive and be readvertised. Vendor-released patches are available and no public exploit code has been identified at time of analysis, so this is a genuine but bounded operational risk.
A specific BGP packet sent by an existing eBGP peer can trigger a NULL pointer dereference in the routing-policy nexthop-ECMP matcher of Juniper Junos OS and Junos OS Evolved, killing the routing daemon and causing a denial of service (CVSS 4.0 base 8.7; independent assessment scores it AV:N/AC:H/PR:N/UI:N/A:H with no confidentiality or integrity impact). Exploitation is gated by two preconditions: the device must have a nexthop-ecmp qualifier attached to a BGP import policy - an explicitly deployed, non-default routing-policy configuration - and the sender must already be a configured eBGP peer, so an arbitrary unauthenticated Internet host cannot reach the flaw; the CVSS vectors carry PR:N, but reachability still requires an established BGP peering session. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor fixes are available per Juniper advisory JSA112187.
Denial of service in Juniper Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to crash the routing protocol daemon (rpd) by sending specifically malformed LSP-ping packets; this is a moderate-priority availability vulnerability, not a critical compromise, because it requires an adjacent-network position and MPLS LSP-ping processing to be enabled. No public exploit has been identified at time of analysis, and Juniper has released fixed software versions for both Junos OS and Junos OS Evolved. Successful exploitation causes only availability impact to rpd, with no data exposure or modification.
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based buffer overflow (CWE-121) in the httpd process that serves the J-Web management interface, reachable by an unauthenticated network attacker who can reach the J-Web HTTP(S) listener. The vendor-assigned CVSS 4.0 score is 9.3 (and our independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. 9.8), reflecting full confidentiality, integrity and availability impact with no authentication or user interaction required; attack complexity is low in the base vector, though the real-world exploitable population is constrained by two configuration prerequisites. Successful exploitation is contingent on J-Web being enabled and a J-Web virtual-domain being configured - a non-default state - so devices with J-Web disabled or no virtual-domain configured are not affected. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid EVPN route advertisements sent by an established BGP/EVPN peer for a configured EVPN-VPWS service, while the identical input causes only an rpd crash (denial of service) on Junos OS Evolved. The underlying defect is a stack-based buffer overflow (CWE-121) in a daemon that runs with root privileges on FreeBSD-based Junos OS, so a successful overflow yields full device compromise, and Juniper has published patched builds under advisory JSA112187. The vendor's CVSS 4.0 base is 9.3 with AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, but real exposure is gated by the requirement that the attacker already hold a configured BGP/EVPN adjacency to the target device; no public exploit code has been identified at time of analysis and there is no KEV confirmation of active exploitation.
Juniper Junos OS and Junos OS Evolved rpd contain a stack-based buffer overflow that an unauthenticated adjacent LDP peer can trigger with a malformed LDP Label Mapping message, causing an rpd crash or potentially arbitrary code execution. Exploitation requires LDP/MPLS to be configured and the attacker to have an LDP adjacency, so exposure is limited to MPLS-enabled routers rather than arbitrary internet-facing systems. Vendor patches are available; no public exploit code has been identified at time of analysis.
A stack-based buffer overflow in the authd authentication daemon of Juniper Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service when both SNMP and AAA are enabled. Exploitation requires valid SNMP read credentials (low-privileged, authenticated) and the specific SNMP+AAA configuration, but no user interaction, making it a credible high-priority risk for devices with exposed SNMP management. Vendor patches are available; no public exploit was identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved, where a specifically malformed BGP UPDATE sent by an eBGP peer that did not negotiate the four-octet-AS (RFC 6793) capability triggers an out-of-bounds write in the routing protocol daemon (rpd), disrupting or crashing the routing control plane on affected devices. The CVSS 4.0 vector (8.7, AV:N/AC:L/PR:N/UI:N/VA:H/SA:L) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) both characterize this as a pure availability-only flaw with no confidentiality or integrity impact. Although PR:N, exploitation is not reachable by an arbitrary off-path internet host: the attacker must hold (or be able to spoof/inject into) an established eBGP session with the target device, and the device must be running BGP with at least one such eBGP neighbor. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Juniper has released fixed builds.
OSPF-triggered denial of service in Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated adjacent OSPF peer crash the routing protocol daemon (rpd) when OSPF Source Packet Routing best-route Prefix-SID installation is configured, causing a reachable assertion (CWE-617) and loss of routing availability. Exploitation is genuinely conditional rather than broad-impact: the target must run the non-default SPRING/segment-routing Prefix-SID configuration, and the attacker must source OSPF traffic from within the routing domain on an adjacency rather than from across the internet, so routers without that feature enabled are not affected. No public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis, and Juniper has released fixed maintenance releases.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved stems from an integer overflow/wraparound in the routing protocol daemon (rpd) OSPFv2 handling, allowing an unauthenticated adjacent attacker to disrupt or crash rpd by sending specifically crafted OSPFv2 packets onto an OSPF-enabled interface. Only devices with OSPFv2 configured and reachable at Layer 2 on the attacker's segment are exposed, which is the primary limiting factor; devices without OSPFv2 running are not affected. Scoring is CVSS 4.0 7.1 and CVSS 3.1 7.1 (AV:A/AC:L/PR:N/UI:N, availability-only impact), no public exploit code has been identified at time of analysis, and vendor patches are available for the affected release trains.
Denial of service in Juniper Networks Junos OS on MX Series routers equipped with SPC3 services line cards and configured for source NAT: the Packet Forwarding Engine fails to drop a specific malformed IPv6 packet and instead creates a session and allocates NAT resources, so sustained delivery of such packets exhausts the session/NAT pool and disrupts all traffic through the device until it is rebooted. The issue is remotely reachable and unauthenticated (no credentials and no user interaction required), and availability-only - there is no path to code execution or data disclosure. Exploitation is constrained by two non-default prerequisites, namely SPC3 hardware and an active source NAT configuration, and no public exploit code has been identified at time of analysis; impact is limited to the affected device profile, so this is a targeted operational-availability risk rather than a universal emergency.
Stack-based buffer overflow in the srxpfe packet-forwarding daemon of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series lets a Layer-2-adjacent attacker execute arbitrary code as root by injecting crafted high-availability fabric traffic. This is a genuinely serious but access-constrained vulnerability: exploitation requires the SRX to be operating in a high-availability chassis cluster, and the attacker must already sit on the same Layer-2 segment as the HA fabric link - the flaw is not reachable over routed networks and does not affect standalone or non-clustered deployments. No authentication or user interaction is required once fabric adjacency is achieved (PR:N/UI:N per the assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector and the vendor CVSS 4.0 score of 8.7), and no public exploit code has been identified at time of analysis; the vendor reports a patch is available via advisory JSA112186.
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routing protocol daemon (rpd) processes crafted BMP route monitoring messages from a configured external BGP neighbor. Exploitation requires the target device to have an established external BGP (eBGP) session with the attacker-controlled peer and BMP route monitoring enabled; routers without BMP configured or without eBGP peers are not exposed. No public exploit code or active exploitation has been identified at time of analysis.
A crafted BGP Prefix-SID (Segment Routing) route that is received and then re-advertised by the rpd routing daemon triggers a numeric truncation error in Juniper Junos OS and Junos OS Evolved 20.4R1 / 20.4R1-EVO and later, letting an unauthenticated network-based attacker cause a denial of service against the affected device. Exposure is limited to devices that actually run BGP with Prefix-SID in use, and the malformed route must be accepted into the BGP control plane and re-advertised, which in realistic deployments implies a BGP adjacency or an upstream/route-injection position rather than arbitrary off-path Internet access. No public exploit identified at time of analysis and no CISA KEV listing; the vendor has published fixed maintenance releases covered by advisory JSA112187, so exposure is a patch-management problem rather than an active campaign.
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, remote attacker execute code as root or crash the device by sending a crafted packet through a configured GRE tunnel. The only meaningful precondition is that a GRE tunnel must be configured and the malformed packet must arrive on that tunnel interface, so SRX deployments without GRE are not exposed; where GRE is enabled the attack is network-reachable, requires no credentials and no user interaction, and the independent assessment rates the resulting impact as high across confidentiality, integrity and availability. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but vendor patches are available and the configuration-dependent exposure makes rapid triage of GRE-enabled SRX fleets worthwhile.
Stack-based buffer overflow in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potentially execute commands with root privileges via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. Exploitation requires that BMP be explicitly enabled (not default) and that the attacker have an established BGP session, meaning a configured neighbor or compromised peer. No public exploit code has been identified at the time of analysis, and the vulnerability is not known to be actively exploited; patched releases are available from Juniper.
A remote, unauthenticated attacker can cause a denial of service in the routing protocol daemon (rpd) of Juniper Junos OS and Junos OS Evolved by sending crafted EVPN multihoming traffic when the device is configured with preference-based designated-forwarder election. The flaw, an infinite loop (CWE-835), halts the routing daemon and affects only availability, with no confidentiality or integrity impact. Exploitation requires the non-default EVPN multihoming feature to be enabled; a vendor patch (JSA112187) is available, and no public exploit has been identified at time of analysis.
A malformed SRv6 structure within an EVPN route update can crash the routing protocol daemon (rpd) on Juniper Junos OS and Junos Evolved, causing a denial of service that disrupts routing adjacencies. The vulnerability affects specific versions of Junos OS and Junos Evolved, and exploitation requires the attacker to be a configured EVPN signaling peer with SRv6 enabled; it is not exploitable by arbitrary off-path hosts. While the CVSS 4.0 score is 8.7, the impact is availability-only; no public exploit code has been identified at time of analysis, and the vendor has released patches.
Malformed BGP EVPN NLRI sent to the routing protocol daemon (rpd) crashes rpd on Juniper Networks Junos OS and Junos OS Evolved, disrupting routing on the affected device until the daemon restarts automatically (CVSS 4.0 base 8.7; assessed CVSS 3.1 7.5 with availability-only impact). Only devices that have BGP EVPN configured with an established peering session are reachable: the attacker must act as a configured BGP EVPN peer - a controlled or compromised peer, or an on-path injection into that session - and needs no credentials or user interaction on the target (PR:N/UI:N). Affected releases span multiple Junos OS and Junos OS Evolved branches (23.2 through 26.2), and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available.
Unauthenticated remote code execution as root affects Juniper Junos OS on MX Series routers that are configured for IKE/IPsec with certificate-based authentication, due to a stack-based buffer overflow in the key management daemon (kmd). An attacker with network access to the IKE service can send specially crafted IKE certificate-based packets to trigger the overflow and execute arbitrary code with root privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the vendor has released patches and the vulnerability carries a critical severity rating (CVSS 9.3 from Juniper, 9.8 assessed).
Denial of service in Juniper Networks Junos OS and Junos OS Evolved rpd allows an attacker with access to a configured BGP peering session to crash the routing protocol daemon by sending a crafted BGP route attribute that is processed while a BGP RIB streaming telemetry subscription is active. Affected are Junos OS and Junos OS Evolved versions 22.1R1 and later (22.1R1-EVO for Evolved); earlier releases are not vulnerable. Exploitation is conditional on both the BGP peer relationship and a non-default telemetry subscription, making this a conditional availability risk rather than a top-tier emergency; no public exploit identified at time of analysis, and vendor patches are available.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to crash the routing protocol daemon (rpd) via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Exploitation requires two non-default preconditions: an established EVPN peering session and an active telemetry sensor subscription; the impact is availability-only (rpd crash) with automatic recovery after daemon restart and reconvergence. No public exploit identified at time of analysis; vendor patch available (see Juniper advisory JSA112187).
Stack-based buffer overflow in Juniper Networks Junos OS and Junos OS Evolved BGP flowspec handling allows a configured BGP flowspec peer to compromise the routing engine or cause a routing-daemon denial of service when BGP update-threading is enabled. The vendor CVSS 4.0 score is 9.3, and the independent assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting a genuinely high-priority issue whose exploitability is more constrained than the critical score alone suggests: the attacker must already be a configured flowspec BGP neighbor, and update-threading must be enabled, so devices without those conditions are not exposed. Vendor patches are available in fixed builds such as Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.4R2-S5, 25.4R1-S3, and 26.2R1-S2 (with corresponding Junos OS Evolved -EVO releases); no public exploit code has been identified at time of analysis.
A denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by an adjacent, unauthenticated attacker who sends crafted IS-IS traffic to a device where both IS-IS link protection and backup-selection are configured, causing an out-of-bounds write in the routing protocol daemon (rpd) that crashes or destabilizes the device. Only routers running these non-default IS-IS feature combinations are exposed, and the attacker must already hold a Layer 2 segment or IS-IS adjacency position (adjacent network, AV:A) rather than reaching the device over the internet. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Juniper has released fixed Junos OS and Junos OS Evolved builds.
A classic buffer overflow (CWE-120) in the SDK service process of Juniper Networks Junos OS lets an unauthenticated attacker on an adjacent network segment crash the process or compromise the Routing Engine by sending specially crafted packets, but only when both the SDK service and a JDAF routing instance are enabled - a non-default configuration. The defect carries a CVSS 4.0 score of 8.7 (assessed as v3.1 AV:A/AC:L/PR:N/UI:N with High confidentiality, integrity, and availability impact), reflecting low-complexity, no-authentication exploitation against feature-enabled devices from an on-link or same-broadcast-domain position. There is no CISA KEV listing and no public exploit identified at time of analysis; Juniper has released fixed maintenance releases, so the practical risk is concentrated on devices running both required features without a patched image.
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause a denial of service via a crafted TCP frame. Exploitation requires the optional SDX/SRC service-deployment feature to be configured and the attacker to hold a man-in-the-middle position on that path (or control/spoof the SDX/SRC server), conditions that significantly limit real-world exposure; no public exploit has been identified at time of analysis. Juniper has issued patches in advisory JSA112187, and the vendor's CVSS 4.0 score of 9.3 is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1).
Remote code execution with root privileges or denial of service in Juniper Networks Junos OS on SRX Series devices is possible through a stack-based buffer overflow in the iked IKE key-management daemon. An authenticated remote-access VPN client on an SRX running affected Junos OS releases can exploit the remote-access VPN authentication and JIMS identity-publishing path; deployments not using remote-access VPN or JIMS identity publishing are not exposed. No public exploit code has been identified at time of analysis, but a vendor patch is available and the vendor CVSS score is 8.7 with high confidentiality, integrity, and availability impact.
Adjacent, unauthenticated code execution as root affects Juniper Junos OS and Junos OS Evolved devices that support Secure-ZTP when their phone-home daemon (phcd) processes a crafted DHCP SZTP bootstrap message. The flaw is a stack-based buffer overflow (CWE-121) that can be triggered by a network-adjacent attacker (CVSS 4.0 AV:A/AC:L/PR:N/UI:N, vendor score 8.7 High); no credentials or user interaction are required, but the target must be a Secure-ZTP-capable platform actively in the DHCP SZTP bootstrap/provisioning state and the attacker must be on the same Layer-2/logical segment. Vendor patches are available; no public exploit code or KEV-listed active exploitation was identified in the provided data.
Unauthenticated adjacent attackers can crash the routing protocol daemon (rpd) on Juniper MX Series devices running Junos OS and ACX Series devices running Junos OS Evolved by sending a malformed IGMPv3 membership report over a directly connected network, producing a denial of service. The defect is a NULL pointer dereference (CWE-476) reached while the device processes IGMPv3 membership traffic, so exploitation requires multicast/IGMP to be configured and active on the receiving interface, and it does not yield any confidentiality or integrity impact. Vendor-reported CVSS 4.0 base score is 7.1 (AV:A, PR:N, UI:N, VA:H), and there is no public exploit identified at time of analysis; a vendor patch is available per Juniper advisory JSA112187 (EUVD-2026-101386).
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, unauthenticated attacker who operates a rogue DHCP server execute arbitrary commands as root on affected EX Series, SRX Series, and QFX Series devices. Exploitation is not remotely routable: the attacker must share a Layer-2 broadcast domain with the target and the device must be actively running phone-home / zero-touch provisioning (ZTP), which is why an independent assessment rates the attack complexity higher than the vendor's 8.7 score despite the high confidentiality, integrity, and availability impact (PR:N/UI:N once those conditions hold). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV entry), though NVIDIA/ENISA EUVD tracking and a full Juniper advisory (JSA112187) with vendor patches indicate this is a genuinely high-priority, patchable issue.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-adjacent attacker to trip a reachable assertion in the bfdd daemon and restart it by sending crafted Bidirectional Forwarding Detection (BFD) session traffic. Only devices running an affected release train with BFD configured on at least one session are exposed, and the impact is confined to availability: repeated daemon restarts can disrupt BFD-based link-failure detection and slow routing convergence, but there is no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and the requirement that the attacker be on the same L2 segment or directly connected link (PR:N, AV:A) sharply limits the attacker population, making this a genuine but constrained availability risk rather than a top-tier emergency.
Stack-based buffer overflow in Juniper Networks Junos OS jdhcpd lets an unauthenticated adjacent attacker crash the DHCP client process with a crafted DHCP response, causing denial of service for DHCP, relay, and zero-touch-provisioning services on devices configured as DHCP clients. Exploitation requires L2 adjacency to the victim and no authentication or user interaction; devices not operating as DHCP clients are not exposed, and service recovers once malicious traffic stops. Vendor patches are available per Juniper advisory JSA112188, and no public exploit code has been identified at time of analysis.
An out-of-bounds read in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated attacker on the adjacent network crash the daemon and disclose limited process memory by sending a crafted Connectivity Fault Management (CFM) message to an interface with CFM configured. Affected releases span Junos OS 23.x through 26.2 and corresponding Junos OS Evolved branches, with fixes available per Juniper advisory JSA112187. Exploitation is bounded by the non-default requirement that CFM be configured on a reachable Layer 2 interface; no public exploit identified at time of analysis.
Stack-based buffer overflow in the cfmd process of Juniper Junos OS and Junos OS Evolved on MX Series and PTX Series platforms enables unauthenticated adjacent-network attackers to execute arbitrary code as root or cause denial of service when enhanced CFM mode and a configured down-MEP are present. The CVSS 8.7 score reflects high confidentiality, integrity, and availability impact, but real-world exposure is constrained by the non-default CFM/802.1ag configuration and the need for Layer 2 adjacency; no public exploit identified at time of analysis.
A stack-based buffer overflow in Juniper's jdhcpd process lets an adjacent, unauthenticated attacker crash or potentially achieve root-level code execution on Junos OS and Junos OS Evolved devices that are configured to use the DHCPv4 local-client feature. Exploitation requires the device to act as a DHCPv4 client and an attacker to sit on the same Layer 2 segment able to deliver a malformed DHCPv4 server response (for example via a rogue or spoofed DHCP server); there is no public exploit identified at time of analysis, but a vendor patch is available. Because jdhcpd runs with root privileges, a successful overflow could yield high confidentiality, integrity and availability impact, making this a mid-to-high priority issue for exposed deployments rather than a universal emergency.
Memory exhaustion in the Juniper Networks Junos OS and Junos OS Evolved l2cpd process allows an unauthenticated attacker on the same Layer 2 segment to disrupt Layer 2 control-plane operations by sending LLDP traffic, but only when the non-default LLDP fast-receive-processing feature is enabled. No authentication or user interaction is required, and the impact is limited to availability (CVSS 3.1 7.1, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity effect. A vendor patch is available through Juniper advisory JSA112187, and no public exploit code has been identified at time of analysis.
A stack-based buffer overflow in the l2cpd (Layer 2 Control Protocol daemon) of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated attacker who is Layer 2 adjacent - on the same broadcast domain or directly cabled to the target interface - crash Layer 2 control-plane processing by sending crafted LLDP packets to an interface with LLDP enabled. The primary outcome is denial of service: repeated triggering can destabilize LLDP and other Layer 2 control protocols on the device, though the assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, ~6.5) rates this as availability-only impact with no confidentiality or integrity loss. Exploitation is gated by two prerequisites - the attacker must already have local Layer 2 presence and the targeted interface must explicitly have LLDP configured - so remote Internet-based attacks are not possible; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and vendor patches are available.
Adjacent unauthenticated attackers can trigger a stack-based buffer overflow in the l2cpd process on Juniper Junos OS and Junos OS Evolved by sending crafted LLDP traffic to an interface configured with Unified Access Policy, potentially causing a denial of service or root-level code execution. Exploitation requires Layer-2 adjacency and the non-default UAP configuration, so this is a high-priority networking vulnerability rather than a universal emergency. No public exploit identified at time of analysis, and a vendor patch is available.
Denial of service in Juniper Networks Junos OS allows an attacker on an adjacent Layer 2 network segment to exhaust resources in the l2cpd (Layer 2 Control Protocol) process, causing the daemon to restart and disrupting Layer 2 control-plane services on the affected device. The attack is unauthenticated and requires no user interaction, but is only reachable when the FNP feature is enabled on a VPLS routing instance that also has VLAN-VPLS encapsulation configured - a specific, non-default deployment that limits exposure; remote internet-based exploitation is not possible. All Junos OS platforms are potentially affected except the PTX Series and SRX Series, and no public exploit code or confirmed active exploitation was identified at time of analysis (the issue is not listed in CISA KEV), though a vendor patch is available.
A crafted MVRP Ethernet frame sent to an MVRP-enabled interface can crash or disrupt the l2cpd Layer 2 control-protocol daemon in Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service for associated Layer 2 control protocols. Only devices with MVRP (Multiple VLAN Registration Protocol) explicitly enabled on at least one interface, and reachable from the same Layer 2 broadcast domain, are exposed - MVRP is not enabled by default, so the vast majority of deployments are not at risk. No authentication or user interaction is required, but the attacker must have Layer 2 adjacency; the frame cannot be delivered across a Layer 3 boundary or over the internet. Scoring is AV:A with high availability impact only (C:N/I:N per the independent CVSS 3.1 assessment); there is no public exploit identified at time of analysis.
Crafted SCTP network traffic can drive the netsctp.ko kernel module on Juniper MX Series routers running affected Junos OS releases into an infinite loop, stalling the SCTP processing path and producing a denial of service against the device. Exploitation is unauthenticated and requires no user interaction (PR:N/UI:N per the assessed vector) - the attacker only needs network reachability to a device that is actually processing SCTP traffic, which in practice means MX platforms used in telecom/mobile signaling roles; routers that do not handle SCTP are not exposed. The vendor has published an advisory and fixed releases, and no public exploit code or confirmed active exploitation was identified at time of analysis (this CVE is not associated with CISA KEV), so the primary risk driver is the size of the exposed, SCTP-handling MX population rather than demonstrated in-the-wild abuse.
An out-of-bounds write (CWE-787) in the lacpd daemon of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to crash the device - a denial of service - by sending a crafted frame to an aggregated-Ethernet member port that has LACP enabled. The attacker needs no authentication or user interaction (PR:N/UI:N) and must be positioned on the same local broadcast domain or directly attached to the member port (AV:A), so this is not an internet-reachable flaw; impact is availability-only (VC:N/VI:N/VA:H, with low subsequent-system availability impact SA:L in the CVSS 4.0 vector, assessed as CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The independent assessment rates this as a genuine but bounded operational risk rather than an emergency: exposure depends entirely on LACP being configured on an AE member port, and no public exploit has been identified at time of analysis (the CVE is not listed in CISA KEV, and no POC is referenced in the available intelligence).
The Juniper Junos OS routing process (rpd) can be crashed by a configured BGP-LS peer sending a specially crafted BGP-LS update, resulting in a denial of service. This reachable assertion vulnerability (CWE-617) affects Junos OS and Junos OS Evolved only when BGP-LS is configured and a peering session is established, requiring the attacker to be an already-trusted, configured BGP-LS peer. No public exploit code or active exploitation has been identified at the time of analysis, but the CVSS score of 8.7 reflects the high availability impact.
An adjacent attacker positioned on the MPLS-TE signaling plane can crash the rpd routing process on Juniper Networks Junos OS and Junos OS Evolved by way of a numeric truncation error (CWE-197) triggered during MPLS-TE fast-reroute signaling, producing a denial of service against the affected router's control plane. Juniper scores this 7.1 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L); our independent assessment maps it to CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, i.e. a high-availability-only impact. Exploitation requires MPLS-TE with fast-reroute (FRR) signaling configured and an attacker able to source or influence that signaling from an adjacent network position - no authentication or user interaction is needed, but default configurations without MPLS-TE FRR are not exposed. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the adjacency plus feature-configuration prerequisites confine realistic exposure largely to service-provider and large-enterprise MPLS cores.
Adjacent, unauthenticated attackers can crash the routing process (rpd) in Juniper Networks Junos OS and Junos OS Evolved by sending crafted RSVP-TE associated-bidirectional LSP signaling messages, resulting in a denial-of-service condition. This reachable assertion (CWE-617) requires the target device to be configured for RSVP-TE with associated-bidirectional LSP signaling and the attacker to be network-adjacent, meaning they must have an RSVP-TE signaling relationship or adjacency to the device. No public exploit identified at time of analysis, and the impact is limited to availability with automatic recovery, not code execution or data exposure.
Malformed RSVP signaling can trip a reachable assertion inside the rpd routing daemon on Juniper Networks Junos OS and Junos OS Evolved, terminating the daemon and causing a denial of service on the affected device. The flaw is exploitable without authentication or user interaction by an attacker positioned on an adjacent network segment (CVSS 4.0 base 7.1; AV:A/PR:N/UI:N with high availability impact), but only when RSVP signaling is actually enabled - typically MPLS traffic-engineering deployments - so devices without RSVP configured are not exposed. At time of analysis there is no public exploit identified and no CISA KEV listing; the practical risk is a bounded availability issue against the control plane rather than a confidentiality or integrity compromise, with JSA112187 as the sole authoritative vendor source.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent, unauthenticated attacker to crash the rpd routing daemon by sending a crafted RSVP Path message, disrupting routing on the affected device (CVSS 7.1; assessed CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, availability-only impact). Exploitation is bounded: the target must have RSVP signaling enabled (typically for MPLS traffic engineering / LSP setup) and the attacker must be reachable at Layer 2 or act as a directly-connected routing neighbor able to inject RSVP control traffic, so arbitrary internet-based attackers are excluded. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the low attack complexity and the unauthenticated nature of the vector make the flaw attractive to anyone already inside the adjacency or peering domain.
A malformed RSVP Path message sent over an EVPL LMP control channel can dereference a NULL pointer in the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd), crashing the process and causing a denial of service. Network-adjacent attackers with Layer 2 reachability to the control channel can trigger the crash without authentication or user interaction, though only devices explicitly configured for EVPL service with an LMP control channel are exposed - a non-default configuration. No public exploit has been identified at time of analysis, and the independent assessment characterizes this as a moderate-severity, targeted availability issue rather than a top-tier emergency.
XML injection in the Unified Threat Management daemon (utmd) of Junos OS on SRX Series devices allows an unauthenticated network attacker to push arbitrary Junos device configuration that the daemon then commits with root privileges, by serving a crafted XML response from a configured custom URL-feed server. Exploitation is not opportunistic: the SRX must be running UTM with a custom URL-category feed pointed at an attacker-influenced server, and the attacker must either control that feed server or be positioned to intercept and modify its response (a MITM), which is why the vendor's CVSS 4.0 score of 9.2 sits alongside an independent assessed vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Impact is total on exposed devices - full confidentiality, integrity and availability loss on the affected SRX - but no public exploit has been identified at time of analysis and there is no confirmed active exploitation. Treat it as a genuine high-priority issue rather than an inflated high-CVSS artifact, and prioritize any SRX running a custom URL-feed.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved: the Layer 2 address learning daemon (l2ald) contains an integer overflow/wraparound (CWE-190) that can be triggered by a crafted EVPN Type-2 (MAC/IP) route advertisement, causing the process to fail and disrupting EVPN-based Layer 2 forwarding. Affected are devices running EVPN with an established, configured BGP peering session; the attacker must control one of those configured EVPN BGP peers, so exposure is limited to environments where EVPN is deployed and peer trust is not strictly enforced. CVSS 8.7 (CVSS 4.0) and 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV). This is a credible operational priority for networks running EVPN, though not a mass-exploitation threat.
Adjacent unauthenticated attackers can cause a denial of service in Juniper Junos OS and Junos OS Evolved by sending a crafted ICCP peer message to the l2ald process, provided MC-LAG IRB MAC synchronization is enabled. The reachable assertion (CWE-617) crashes the l2ald daemon, affecting availability; this is a conditional DoS requiring a non-default MC-LAG configuration and adjacency to the inter-chassis control link. No public exploit identified at time of analysis; EPSS data not provided.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by a malformed MC-LAG message sent to the l2ald daemon, causing a reachable assertion failure and daemon crash. Only devices explicitly configured for MC-LAG with ICCP peering enabled are affected, and the attacker must hold the network position of a configured ICCP peer (adjacent Layer 2 access). No public exploit code or active exploitation has been identified; the issue is availability-only with no confidentiality or integrity impact.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by an adjacent attacker sending a crafted ICCP MC-LAG message to l2ald, causing the daemon to mishandle a specified quantity field. The flaw only affects devices configured for MC-LAG with ICCP active and the attacker must be on the Layer-2 adjacency or ICCP peering path; no authentication or user interaction is required once that adjacency is achieved, and impact is availability-only (no data exposure or code execution). No public exploit identified at time of analysis, and the independent assessment rates this as a genuine but situational priority rather than a top-tier emergency because the non-default MC-LAG/ICCP prerequisite and adjacency constraint sharply reduce the realistic attacker population.
Memory exhaustion in the l2ald (Layer 2 address learning) daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a denial of service against the device by sending crafted packets, but only when the non-default static MAC-IP EVPN feature is configured. The flaw is tracked as CWE-401 (Missing Release of Memory after Effective Lifetime), meaning the daemon fails to free memory it has allocated, so repeated crafted traffic can drain resources and disrupt the l2ald process; per the assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) impact is availability-only and the attacker must sit on the same Layer-2 segment as the target. No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is limited because the static MAC-IP feature is not enabled by default and routed/remote attackers cannot reach the vulnerable path.
Authenticated, low-privileged TACACS+ users on Juniper Networks Junos OS Evolved can escalate to root and execute arbitrary OS commands, but only when the periodic TACACS+ authorization-refresh feature is enabled - an OS command injection flaw (CWE-78) that requires both a valid low-privileged TACACS+ account and that specific configuration to be active. The vendor rates it 9.3, while our independent assessment scores it CVSS:3.1 9.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting that exploitation is not possible by an anonymous remote attacker despite the vendor's PR:N vector. There is no public exploit identified at time of analysis, and the flaw does not trigger on devices using TACACS+ without authorization-refresh, or on devices using RADIUS or local authentication.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved affects the rpd routing process, which can be disrupted when a configured MVPN neighbor sends a crafted BGP MVPN update to a device running a non-default inter-region segmented VRF configured with 'protocols mvpn inter-region-template'. Exposure is narrow but real: the target must have that specialized multicast-VPN configuration and an established BGP MVPN peering relationship with the sender, and the CVSS 4.0 vector is unauthenticated (PR:N) with network reachability. Impact is availability-only (rpd disruption with automatic recovery, no confidentiality or integrity loss), the base score is 8.7 High with a low subsequent-system availability effect (SA:L) indicating a scope-crossing impact on routing, and no public exploit code or confirmed active exploitation is identified at time of analysis.
A NULL pointer dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved crashes the daemon and causes a denial of service when a routing policy that uses AS-path expansion is evaluated against MSDP or PIM data. Exploitation is constrained by non-default configuration: the device must have MSDP or PIM enabled together with an AS-path-expansion policy, and the attacker must either already be a configured MSDP peer or be an adjacent PIM sender able to inject PIM messages. Juniper rates the 4.0 base score at 8.7 with network reach, low complexity, and PR:N per the vector, but the real limiting factors are positional (established peering or adjacency) and configuration-specific rather than arbitrary-internet reachable; impact is availability only, with no data exposure, integrity loss, or code execution, and no public exploit identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved arises when the routing protocol daemon (rpd) dereferences a NULL pointer while processing multiple BGP UPDATE messages delivered over a single TCP session, but only with the non-default 'bgp family l2vpn auto-discovery-only' BGP family configured. A remote BGP peer can crash rpd and interrupt routing services on the affected device; the daemon recovers, and there is no confidentiality or integrity impact. Exploitation requires an already-established, configured BGP adjacency rather than arbitrary internet access, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Malformed BGP labeled-unicast UPDATE messages can crash the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on affected routers (CVSS 8.7). Per the vendor CVSS vector the attack is unauthenticated (PR:N), but exploitation in practice requires two concrete preconditions: the sender must be a configured eBGP neighbor with an established BGP peering session to the target, and the affected BGP multipath features must be enabled on the router, with the trigger arriving as labeled-unicast UPDATEs. Impact is availability only - rpd crashes with no confidentiality or integrity effect - and no public exploit code has been identified at time of analysis, so this is primarily an operational-availability risk for Juniper networks that peer eBGP with external or less-trusted parties and run multipath.
A crafted BGP route update sent by an adjacent eBGP peer can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved devices that have RIB sharding enabled, producing a denial-of-service condition affecting routing availability. Per the independent assessment, exploitation requires two non-trivial preconditions: RIB sharding must be explicitly configured (it is not a default setting), and the attacker must already hold an established eBGP peering session with the target; the assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is unauthenticated but adjacent, with availability-only impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a high-severity but condition-gated DoS rather than a code-execution or data-exposure flaw; devices without RIB sharding or peering only with trusted neighbors are not realistically exposed.
Juniper Networks Junos OS and Junos OS Evolved can have their routing protocol daemon (rpd) crashed by a crafted BGP route update, producing a routing-layer denial of service on devices that combine extended next-hop tunneling with SRv6 service processing. Only deployments with both of these non-default, service-provider-oriented features active are exposed, and the traffic must arrive over an established BGP peering session, so real-world exposure is narrow; the impact is availability-only with no confidentiality or integrity loss. No public exploit code and no CISA KEV entry were identified at time of analysis, and the referenced Juniper advisory (JSA112187) is the authoritative source for affected versions.
Crafted BGP route updates sent by an established BGP peer can trigger an integer overflow in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved, crashing the process and causing a denial of service. The flaw is only reachable when the non-default extended-nexthop-tunnel feature is explicitly enabled on the target device, and the attacker must already hold a configured BGP peering relationship with the device, meaning a trusted routing position is a prerequisite rather than anonymous internet exposure. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor CVSS 4.0 score of 8.7 reflects high availability impact on the local system with no confidentiality or integrity exposure; note that the vendor vector lists PR:N while the vendor's own description and our assessment specify an authenticated BGP peer, a conflict that should be resolved using the description's authentication requirement.
Denial of service in Juniper Networks Junos OS Evolved can be triggered by a crafted SNMP query to the firewall-counter MIB, causing the fwstatsd daemon to hit a reachable assertion and terminate, which disrupts device availability when at least one firewall counter is configured. The advisory describes an authenticated network attacker and the independent assessment's CVSS 3.1 vector (PR:L) reflects an authenticated prerequisite, while the supplied CVSS 4.0 vector lists PR:N, an inconsistency that should be verified against Juniper's advisory. No public exploit code or active exploitation has been identified at time of analysis.
A crafted BGP-LS Link NLRI advertisement sent over an established BGP-LS peering session can trigger a reachable assertion inside the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved, causing rpd to crash and disrupting the device's routing control plane. Impact is limited to availability - no code execution, data disclosure, or integrity impact occurs - and only devices explicitly configured with BGP-LS and peered with the attacker's BGP-LS speaker are exposed, meaning the attacker must occupy or control one of the operator-provisioned BGP-LS peers. This is a credible operational-risk denial-of-service issue rather than a code-execution or data-breach threat; no public exploit code identified at time of analysis, and vendor patches are available per Juniper advisory JSA112187.
A NULL pointer dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker on an adjacent network to terminate the daemon and disrupt routing protocol sessions by sending a crafted RSVP packet when MPLS-TE RSVP processing is enabled; the flaw carries a CVSS v4.0 base score of 7.1 (CVSS:3.1 equivalent AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects availability only, with no confidentiality or integrity impact. Exposure is bounded by two prerequisites - the device must actually be configured for RSVP-TE/MPLS-TE signaling, and the attacker must sit on the same L2 segment, directly connected link, or adjacent routing/peering domain rather than being reachable from the open internet. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (not listed in CISA KEV); EPSS data was not provided in the available intelligence.
Denial of service affecting the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved is triggered when crafted or malformed BGP-LS (BGP Link-State) routing updates hit a reachable assertion in the daemon, causing it to terminate. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the attacker must hold a valid, authenticated BGP peering session with the target and the device must be configured for BGP-LS; devices that do not run BGP-LS, or that peer only with trusted and uncompromised neighbors, are not realistically exposed. Impact is confined to availability of the rpd process with automatic recovery, no confidentiality or integrity impact applies, no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Malformed RIPv2 messages delivered to the routing protocol daemon (rpd) can crash or otherwise disrupt routing on Juniper Networks Junos OS and Junos Evolved, producing a denial-of-service condition. Exploitation requires the attacker to be network-adjacent (same link or broadcast domain) and requires that RIPv2 be actively configured and enabled on the target; no authentication or user interaction is needed, and the impact is availability-only, with no confidentiality or integrity effect. The issue is rated CVSS 7.1 (CVSS 4.0 basis) and CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, making this a moderate-risk availability issue rather than a top-tier emergency.
A NULL pointer dereference in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker positioned on an adjacent Layer 2 segment or as a multicast/routing peer to crash the routing protocol process by sending a malformed PIM Bidirectional (Bidir) message, producing a denial-of-service condition (CVSS 7.1). Exposure is gated by configuration: the target device must be running PIM Bidir, a non-default multicast feature, which means only networks actively deploying bidirectional PIM are at risk, and the attacker must be able to deliver a PIM packet directly to rpd rather than across arbitrary routed networks. Impact is confined to availability of the routing control plane - no code execution, data disclosure, or configuration integrity impact - and there is no public exploit identified at time of analysis.
Denial of service in the Juniper Junos OS rpd routing process is possible when the non-default Auto-RP mapping feature is enabled, allowing an unauthenticated attacker on an adjacent network segment to send crafted Auto-RP mapping announcements that trigger an out-of-bounds write (CWE-787) and crash the routing plane. Juniper rates this CVSS 4.0 7.1, and our independent assessment concurs it is a moderate-priority availability issue rather than a critical emergency; no public exploit code or CISA KEV entry was identified at time of analysis. The attacker must be within the PIM multicast domain and cannot reach the device from the general internet.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered when the routing protocol daemon (rpd) fails to properly validate a quantity field carried in a BGP MVPN (Multicast VPN) signaling update, allowing the crafted message to disrupt rpd and impair routing on the affected device. Exploitation is constrained by a strong precondition: the target must be configured for BGP MVPN signaling, and the sender must be - or must impersonate - an already configured, established BGP MVPN peer, so exposure is limited to the BGP MVPN peering trust boundary rather than arbitrary internet hosts. Impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 score 8.7), with supplemental metrics indicating automatic recovery; no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Heap-based buffer overflow in the secure-dot1xd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service by sending a crafted EAPOL frame to an 802.1X-authenticated interface. Exploitation requires the targeted interface to be configured for 802.1X port-based authentication and Layer 2 adjacency, and no public exploit has been identified at time of analysis. With a CVSS 4.0 score of 8.7, this is a high-priority flaw for affected deployments using 802.1X.
Stack-based buffer overflow in the authd process of Juniper Networks Junos OS allows an attacker who can influence a configured RADIUS server to crash the device or execute arbitrary code with root privileges. This unauthenticated, adjacent-network attack (CVSS 8.7) is limited to devices that have RADIUS authentication enabled and where the attacker either controls the RADIUS server or can inject or modify RADIUS responses on the adjacent network. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed (not in CISA KEV).
Remote, unauthenticated attackers can crash the na-grpcd daemon on Juniper Networks Junos OS Evolved by sending a crafted gRPC telemetry subscription request, causing a denial of service. This affects devices where the gRPC telemetry subscription service is enabled and reachable; no public exploit code is known, and the process restarts automatically, limiting outage duration. The CVSS 4.0 score is 8.7 (High), while the independent assessment rates availability impact as High (CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Adjacent Layer-2 attackers can crash the rpd routing daemon on Juniper Networks Junos OS and Junos OS Evolved devices that run LDP across a link-protected interface, producing a denial of service when two misconfigured LDP neighbors - or a single neighbor duplicated by an L2 loop - advertise the same transport address and trip an internal assertion in the daemon. The CVSS vector (AV:A/PR:N, no confidentiality or integrity impact) shows the attack is unauthenticated but requires link adjacency plus an established LDP session and a non-default misconfiguration or L2 loop, so exposure is conditional rather than universal and is confined to availability; recovery is assessed as automatic (R:A) because the daemon restarts after the crash. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS-style urgency signals in the supplied data do not indicate mass scanning or confirmed in-the-wild abuse.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved results from a reachable assertion (CWE-617) in the rpd routing process that can be triggered by adjacent unauthenticated attackers sending LDP control traffic. Devices with Label Distribution Protocol (LDP) configured and active are exposed; the attacker must be on the same Layer 2 segment or directly connected link, but no authentication or user interaction is required. No public exploit code has been identified, and CISA KEV does not list this vulnerability as actively exploited.
A reachable-assertion flaw in the Juniper Junos OS and Junos OS Evolved rpd routing daemon lets a network-adjacent attacker crash the daemon by sending a crafted LDP Label message that carries an IPv6 Prefix FEC, producing a denial-of-service condition (CVSS 4.0 base 7.1; availability-only). The attacker must already share an L2 segment or act as a directly connected routing peer and must have an established LDP session with the target, so only devices with LDP configured and actively exchanging IPv6 Prefix FEC bindings are exposed; no authentication or user interaction is required once that adjacency exists (PR:N, UI:N), and the daemon's automatic restart bounds each outage. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); impact is limited to availability, with no confidentiality or integrity effect.
Juniper Junos OS and Junos OS Evolved devices that run OSPFv3 on a broadcast interface can be crashed by an unauthenticated adjacent attacker who sends specially crafted OSPFv3 protocol messages to the rpd routing daemon, producing a denial of service and heap memory corruption. Exploitation requires only Layer-2 adjacency to the affected broadcast segment and no credentials or user interaction, but devices that do not run OSPFv3, or that use point-to-point interface types, are not exposed; no public exploit code has been identified at time of analysis. Vendor severity is moderate (CVSS 4.0 7.1) with an availability-only impact, aligning with our independent CVSS 3.1 assessment of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Adjacent, unauthenticated attackers can crash the rpd routing protocol daemon on Juniper Networks Junos OS and Junos OS Evolved devices that are configured for sparse-mode PIM, exploiting a use-after-free flaw triggered by specific PIM Join/Prune messages. Successful exploitation causes a denial of service through daemon failure and subsequent routing churn, with no impact on confidentiality or integrity. Exploitation is conditional: the target must run PIM sparse mode and the attacker must already sit on an adjacent multicast/routing segment with a valid PIM adjacency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor advisory JSA112187 is the authoritative source for affected and fixed releases.
Malformed PIM Hello messages can crash the rpd process in Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on IPv6-enabled PIM interfaces. This improper input validation flaw (CWE-20) is exploitable by an unauthenticated adjacent attacker (AV:A) without user interaction, but requires PIM to be configured and the target interface to be IPv6-enabled. No public exploit code or active exploitation is known; the CVSS 4.0 base score is 7.1, and independent assessment classifies this as a moderate-severity availability issue with a bounded exposed population.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker who already holds an established EVPN BGP peering relationship with a target device to disrupt the routing protocol daemon (rpd) by sending EVPN BGP routes that trigger an integer overflow or wraparound. The flaw affects EVPN-enabled routing instances and can tear down control-plane adjacencies and halt route processing, producing an availability-only impact with no confidentiality or integrity effect. EVPN is a deliberately configured, non-default feature and the peering trust relationship must pre-exist, so realistic exploitation is limited to EVPN deployments and adjacent or compromised BGP peers; no public exploit code was identified at time of analysis, and the vendor advisory is Juniper JSA112187.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, peer-trusted attacker to crash the routing protocol daemon (rpd) by sending specially crafted EVPN route updates. Exploitation requires an established, accepted EVPN BGP peering session with the attacker controlling or compromising the peer endpoint; routers without EVPN/BGP signaling configured or without the attacker in their accepted-peer set are not exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis; risk is limited to availability (no confidentiality or integrity impact), but the flaw is a genuine operational priority for networks running EVPN.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-positioned attacker to disrupt the routing protocol daemon (rpd) by delivering a crafted BGP EVPN update message. Affected releases include multiple Junos OS and Junos OS Evolved versions, but exposure requires that BGP with the EVPN address family be configured - a non-default setting typical of EVPN-VXLAN data center fabrics - and the attacker must be able to reach rpd over an established BGP EVPN session (a configured peer or an on-path attacker on the peering path). Impact is availability-only (control-plane DoS) with no confidentiality or integrity exposure; no public exploit identified at time of analysis, and vendor patches are available.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered in the routing protocol daemon (rpd) by a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. The vendor rates this 8.7, while independent assessment maps it to high availability impact (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss; the practical precondition is an established EVPN peering relationship, so an arbitrary internet host is not sufficient despite the unauthenticated CVSS vector. No public exploit code or CISA KEV active exploitation is identified in the provided data at time of analysis, and affected deployments are those running EVPN on unpatched Junos OS or Junos OS Evolved releases.
Denial of service in Juniper Junos OS and Junos OS Evolved rpd allows a configured BGP neighbor to crash the routing protocol daemon by sending a crafted BGP route update when both resolution-map routing policy and policy event-tracing are enabled. The flaw is a NULL pointer dereference (CWE-476) affecting multiple release trains; exploitation requires the non-default combination of those two features and an existing BGP peering relationship, so baseline or non-peered devices are not exposed. Juniper has released patches via advisory JSA112187, and no public exploit identified at time of analysis.
A NULL pointer dereference in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated, already-configured BGP peer crash the routing process by sending a crafted BGP UPDATE, producing a denial of service, but only on devices where both ISO-VPN and egress-protection are enabled - a non-default feature combination. The CVSS 4.0 vector scores 8.7 (High) and is driven entirely by availability impact (VC:N/VI:N/VA:H/SC:N/SI:N/SA:L), with no confidentiality or integrity loss. No public exploit code and no confirmed active exploitation were identified at time of analysis; arbitrary Internet hosts cannot reach the vulnerable code path because the sender must already be an operator-configured BGP peer of the target device.
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Junos OS Evolved devices through the J-Web management interface when web management is enabled, due to improper authentication in NETCONF session handling. This is a critical vulnerability (CVSS 9.3/9.8) that requires only network reachability to the J-Web HTTP/HTTPS service; no credentials or user interaction are needed. No public exploit code or active exploitation has been identified at time of analysis, but the risk is genuine and high-priority as noted in independent assessment, not merely a high-CVSS artifact.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved: a malformed BGP ISO-VPN (CLNS/IS-IS L3VPN) update from an accepted ISO-VPN peer crashes the routing protocol daemon (rpd) when that update is subsequently handled by BMP route monitoring or by NSR replication, taking down routing on the affected device (CVSS 4.0 base 8.7; AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and SA:L). Exploitation requires no credentials on the wire, but it is gated by a pre-established BGP ISO-VPN peering relationship, so realistic exposure is limited to compromised or malicious peers rather than arbitrary internet hosts, and the device must additionally have BMP route monitoring or NSR enabled. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; exploitation yields only availability impact, with no confidentiality or integrity loss on the router itself.
A crafted VPN-flowspec BGP update can crash the routing protocol daemon (rpd) on Juniper Junos OS and Junos OS Evolved, causing a denial of service, but only when that update is readvertised by the device and BMP post-policy RIB-out monitoring is explicitly configured. The flaw is a NULL pointer dereference (CWE-476) reachable by a remote BGP peer that already has an established peering session with the target (PR:N means no device-level authentication is required, but a configured neighbor relationship is a practical prerequisite). The vendor rates it 8.7 under CVSS 4.0 while our independent assessment scores it 7.5 under CVSS 3.1 (AC:H), reflecting the non-default BMP configuration and readvertisement conditions; impact is availability-only with no confidentiality or integrity effect, and no public exploit code has been identified at time of analysis.
Adjacent attackers can crash the Juniper Networks Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted LDP packet into an already-established LDP session, causing a denial of service on the affected router. Only devices running MPLS with LDP enabled and an active LDP peering session are exposed, and the attacker must already hold a position on the adjacent network capable of injecting packets into that session (CVSS 3.1 AV:A/AC:L/PR:N/UI:N with availability-only impact; vendor CVSS 4.0 base 7.1). There is no confidentiality or integrity impact - the outcome is loss of rpd availability, though repeated crashes can degrade routing stability; no public exploit has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).
Denial of service in Juniper Junos OS and Junos OS Evolved can be triggered by a remote BGP EVPN neighbor when SRv6 EVPN multihoming is configured, causing the routing protocol daemon (rpd) to crash. The issue affects specific Junos OS trains (25.2, 25.4, 26.2) and Junos OS Evolved trains (23.4X100, 25.2, 25.2X100, 25.4, 25.4X300, 26.2) below their fixed service releases. No public exploit identified at time of analysis, and exploitation is gated by the non-default SRv6 EVPN multihoming configuration plus an established BGP EVPN peering relationship.
Denial of service affecting Juniper Networks Junos OS and Junos OS Evolved: an unauthenticated remote attacker who can deliver a specifically malformed BGP EVPN multicast update to a device configured for EVPN multicast can crash the routing protocol daemon (rpd) when that update is processed for readvertisement, taking down routing on the affected box. Per the vendor's CVSS 4.0 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), the impact is availability-only, but exposure is bounded by a real prerequisite: the target must run EVPN multicast (e.g. EVPN handling of IGMP/MLD / SMET multicast routes) with a live BGP session, and the attacker needs a peering relationship or on-path injection capability for the update to arrive and be readvertised. Vendor-released patches are available and no public exploit code has been identified at time of analysis, so this is a genuine but bounded operational risk.
A specific BGP packet sent by an existing eBGP peer can trigger a NULL pointer dereference in the routing-policy nexthop-ECMP matcher of Juniper Junos OS and Junos OS Evolved, killing the routing daemon and causing a denial of service (CVSS 4.0 base 8.7; independent assessment scores it AV:N/AC:H/PR:N/UI:N/A:H with no confidentiality or integrity impact). Exploitation is gated by two preconditions: the device must have a nexthop-ecmp qualifier attached to a BGP import policy - an explicitly deployed, non-default routing-policy configuration - and the sender must already be a configured eBGP peer, so an arbitrary unauthenticated Internet host cannot reach the flaw; the CVSS vectors carry PR:N, but reachability still requires an established BGP peering session. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor fixes are available per Juniper advisory JSA112187.
Denial of service in Juniper Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to crash the routing protocol daemon (rpd) by sending specifically malformed LSP-ping packets; this is a moderate-priority availability vulnerability, not a critical compromise, because it requires an adjacent-network position and MPLS LSP-ping processing to be enabled. No public exploit has been identified at time of analysis, and Juniper has released fixed software versions for both Junos OS and Junos OS Evolved. Successful exploitation causes only availability impact to rpd, with no data exposure or modification.
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based buffer overflow (CWE-121) in the httpd process that serves the J-Web management interface, reachable by an unauthenticated network attacker who can reach the J-Web HTTP(S) listener. The vendor-assigned CVSS 4.0 score is 9.3 (and our independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. 9.8), reflecting full confidentiality, integrity and availability impact with no authentication or user interaction required; attack complexity is low in the base vector, though the real-world exploitable population is constrained by two configuration prerequisites. Successful exploitation is contingent on J-Web being enabled and a J-Web virtual-domain being configured - a non-default state - so devices with J-Web disabled or no virtual-domain configured are not affected. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid EVPN route advertisements sent by an established BGP/EVPN peer for a configured EVPN-VPWS service, while the identical input causes only an rpd crash (denial of service) on Junos OS Evolved. The underlying defect is a stack-based buffer overflow (CWE-121) in a daemon that runs with root privileges on FreeBSD-based Junos OS, so a successful overflow yields full device compromise, and Juniper has published patched builds under advisory JSA112187. The vendor's CVSS 4.0 base is 9.3 with AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, but real exposure is gated by the requirement that the attacker already hold a configured BGP/EVPN adjacency to the target device; no public exploit code has been identified at time of analysis and there is no KEV confirmation of active exploitation.
Juniper Junos OS and Junos OS Evolved rpd contain a stack-based buffer overflow that an unauthenticated adjacent LDP peer can trigger with a malformed LDP Label Mapping message, causing an rpd crash or potentially arbitrary code execution. Exploitation requires LDP/MPLS to be configured and the attacker to have an LDP adjacency, so exposure is limited to MPLS-enabled routers rather than arbitrary internet-facing systems. Vendor patches are available; no public exploit code has been identified at time of analysis.
A stack-based buffer overflow in the authd authentication daemon of Juniper Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service when both SNMP and AAA are enabled. Exploitation requires valid SNMP read credentials (low-privileged, authenticated) and the specific SNMP+AAA configuration, but no user interaction, making it a credible high-priority risk for devices with exposed SNMP management. Vendor patches are available; no public exploit was identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved, where a specifically malformed BGP UPDATE sent by an eBGP peer that did not negotiate the four-octet-AS (RFC 6793) capability triggers an out-of-bounds write in the routing protocol daemon (rpd), disrupting or crashing the routing control plane on affected devices. The CVSS 4.0 vector (8.7, AV:N/AC:L/PR:N/UI:N/VA:H/SA:L) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) both characterize this as a pure availability-only flaw with no confidentiality or integrity impact. Although PR:N, exploitation is not reachable by an arbitrary off-path internet host: the attacker must hold (or be able to spoof/inject into) an established eBGP session with the target device, and the device must be running BGP with at least one such eBGP neighbor. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Juniper has released fixed builds.
OSPF-triggered denial of service in Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated adjacent OSPF peer crash the routing protocol daemon (rpd) when OSPF Source Packet Routing best-route Prefix-SID installation is configured, causing a reachable assertion (CWE-617) and loss of routing availability. Exploitation is genuinely conditional rather than broad-impact: the target must run the non-default SPRING/segment-routing Prefix-SID configuration, and the attacker must source OSPF traffic from within the routing domain on an adjacency rather than from across the internet, so routers without that feature enabled are not affected. No public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis, and Juniper has released fixed maintenance releases.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved stems from an integer overflow/wraparound in the routing protocol daemon (rpd) OSPFv2 handling, allowing an unauthenticated adjacent attacker to disrupt or crash rpd by sending specifically crafted OSPFv2 packets onto an OSPF-enabled interface. Only devices with OSPFv2 configured and reachable at Layer 2 on the attacker's segment are exposed, which is the primary limiting factor; devices without OSPFv2 running are not affected. Scoring is CVSS 4.0 7.1 and CVSS 3.1 7.1 (AV:A/AC:L/PR:N/UI:N, availability-only impact), no public exploit code has been identified at time of analysis, and vendor patches are available for the affected release trains.
Denial of service in Juniper Networks Junos OS on MX Series routers equipped with SPC3 services line cards and configured for source NAT: the Packet Forwarding Engine fails to drop a specific malformed IPv6 packet and instead creates a session and allocates NAT resources, so sustained delivery of such packets exhausts the session/NAT pool and disrupts all traffic through the device until it is rebooted. The issue is remotely reachable and unauthenticated (no credentials and no user interaction required), and availability-only - there is no path to code execution or data disclosure. Exploitation is constrained by two non-default prerequisites, namely SPC3 hardware and an active source NAT configuration, and no public exploit code has been identified at time of analysis; impact is limited to the affected device profile, so this is a targeted operational-availability risk rather than a universal emergency.
Stack-based buffer overflow in the srxpfe packet-forwarding daemon of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series lets a Layer-2-adjacent attacker execute arbitrary code as root by injecting crafted high-availability fabric traffic. This is a genuinely serious but access-constrained vulnerability: exploitation requires the SRX to be operating in a high-availability chassis cluster, and the attacker must already sit on the same Layer-2 segment as the HA fabric link - the flaw is not reachable over routed networks and does not affect standalone or non-clustered deployments. No authentication or user interaction is required once fabric adjacency is achieved (PR:N/UI:N per the assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector and the vendor CVSS 4.0 score of 8.7), and no public exploit code has been identified at time of analysis; the vendor reports a patch is available via advisory JSA112186.
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routing protocol daemon (rpd) processes crafted BMP route monitoring messages from a configured external BGP neighbor. Exploitation requires the target device to have an established external BGP (eBGP) session with the attacker-controlled peer and BMP route monitoring enabled; routers without BMP configured or without eBGP peers are not exposed. No public exploit code or active exploitation has been identified at time of analysis.
A crafted BGP Prefix-SID (Segment Routing) route that is received and then re-advertised by the rpd routing daemon triggers a numeric truncation error in Juniper Junos OS and Junos OS Evolved 20.4R1 / 20.4R1-EVO and later, letting an unauthenticated network-based attacker cause a denial of service against the affected device. Exposure is limited to devices that actually run BGP with Prefix-SID in use, and the malformed route must be accepted into the BGP control plane and re-advertised, which in realistic deployments implies a BGP adjacency or an upstream/route-injection position rather than arbitrary off-path Internet access. No public exploit identified at time of analysis and no CISA KEV listing; the vendor has published fixed maintenance releases covered by advisory JSA112187, so exposure is a patch-management problem rather than an active campaign.
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, remote attacker execute code as root or crash the device by sending a crafted packet through a configured GRE tunnel. The only meaningful precondition is that a GRE tunnel must be configured and the malformed packet must arrive on that tunnel interface, so SRX deployments without GRE are not exposed; where GRE is enabled the attack is network-reachable, requires no credentials and no user interaction, and the independent assessment rates the resulting impact as high across confidentiality, integrity and availability. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but vendor patches are available and the configuration-dependent exposure makes rapid triage of GRE-enabled SRX fleets worthwhile.
Stack-based buffer overflow in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potentially execute commands with root privileges via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. Exploitation requires that BMP be explicitly enabled (not default) and that the attacker have an established BGP session, meaning a configured neighbor or compromised peer. No public exploit code has been identified at the time of analysis, and the vulnerability is not known to be actively exploited; patched releases are available from Juniper.
A remote, unauthenticated attacker can cause a denial of service in the routing protocol daemon (rpd) of Juniper Junos OS and Junos OS Evolved by sending crafted EVPN multihoming traffic when the device is configured with preference-based designated-forwarder election. The flaw, an infinite loop (CWE-835), halts the routing daemon and affects only availability, with no confidentiality or integrity impact. Exploitation requires the non-default EVPN multihoming feature to be enabled; a vendor patch (JSA112187) is available, and no public exploit has been identified at time of analysis.
A malformed SRv6 structure within an EVPN route update can crash the routing protocol daemon (rpd) on Juniper Junos OS and Junos Evolved, causing a denial of service that disrupts routing adjacencies. The vulnerability affects specific versions of Junos OS and Junos Evolved, and exploitation requires the attacker to be a configured EVPN signaling peer with SRv6 enabled; it is not exploitable by arbitrary off-path hosts. While the CVSS 4.0 score is 8.7, the impact is availability-only; no public exploit code has been identified at time of analysis, and the vendor has released patches.
Malformed BGP EVPN NLRI sent to the routing protocol daemon (rpd) crashes rpd on Juniper Networks Junos OS and Junos OS Evolved, disrupting routing on the affected device until the daemon restarts automatically (CVSS 4.0 base 8.7; assessed CVSS 3.1 7.5 with availability-only impact). Only devices that have BGP EVPN configured with an established peering session are reachable: the attacker must act as a configured BGP EVPN peer - a controlled or compromised peer, or an on-path injection into that session - and needs no credentials or user interaction on the target (PR:N/UI:N). Affected releases span multiple Junos OS and Junos OS Evolved branches (23.2 through 26.2), and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available.
Unauthenticated remote code execution as root affects Juniper Junos OS on MX Series routers that are configured for IKE/IPsec with certificate-based authentication, due to a stack-based buffer overflow in the key management daemon (kmd). An attacker with network access to the IKE service can send specially crafted IKE certificate-based packets to trigger the overflow and execute arbitrary code with root privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the vendor has released patches and the vulnerability carries a critical severity rating (CVSS 9.3 from Juniper, 9.8 assessed).
Denial of service in Juniper Networks Junos OS and Junos OS Evolved rpd allows an attacker with access to a configured BGP peering session to crash the routing protocol daemon by sending a crafted BGP route attribute that is processed while a BGP RIB streaming telemetry subscription is active. Affected are Junos OS and Junos OS Evolved versions 22.1R1 and later (22.1R1-EVO for Evolved); earlier releases are not vulnerable. Exploitation is conditional on both the BGP peer relationship and a non-default telemetry subscription, making this a conditional availability risk rather than a top-tier emergency; no public exploit identified at time of analysis, and vendor patches are available.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to crash the routing protocol daemon (rpd) via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Exploitation requires two non-default preconditions: an established EVPN peering session and an active telemetry sensor subscription; the impact is availability-only (rpd crash) with automatic recovery after daemon restart and reconvergence. No public exploit identified at time of analysis; vendor patch available (see Juniper advisory JSA112187).
Stack-based buffer overflow in Juniper Networks Junos OS and Junos OS Evolved BGP flowspec handling allows a configured BGP flowspec peer to compromise the routing engine or cause a routing-daemon denial of service when BGP update-threading is enabled. The vendor CVSS 4.0 score is 9.3, and the independent assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting a genuinely high-priority issue whose exploitability is more constrained than the critical score alone suggests: the attacker must already be a configured flowspec BGP neighbor, and update-threading must be enabled, so devices without those conditions are not exposed. Vendor patches are available in fixed builds such as Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.4R2-S5, 25.4R1-S3, and 26.2R1-S2 (with corresponding Junos OS Evolved -EVO releases); no public exploit code has been identified at time of analysis.
A denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by an adjacent, unauthenticated attacker who sends crafted IS-IS traffic to a device where both IS-IS link protection and backup-selection are configured, causing an out-of-bounds write in the routing protocol daemon (rpd) that crashes or destabilizes the device. Only routers running these non-default IS-IS feature combinations are exposed, and the attacker must already hold a Layer 2 segment or IS-IS adjacency position (adjacent network, AV:A) rather than reaching the device over the internet. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Juniper has released fixed Junos OS and Junos OS Evolved builds.
A classic buffer overflow (CWE-120) in the SDK service process of Juniper Networks Junos OS lets an unauthenticated attacker on an adjacent network segment crash the process or compromise the Routing Engine by sending specially crafted packets, but only when both the SDK service and a JDAF routing instance are enabled - a non-default configuration. The defect carries a CVSS 4.0 score of 8.7 (assessed as v3.1 AV:A/AC:L/PR:N/UI:N with High confidentiality, integrity, and availability impact), reflecting low-complexity, no-authentication exploitation against feature-enabled devices from an on-link or same-broadcast-domain position. There is no CISA KEV listing and no public exploit identified at time of analysis; Juniper has released fixed maintenance releases, so the practical risk is concentrated on devices running both required features without a patched image.
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause a denial of service via a crafted TCP frame. Exploitation requires the optional SDX/SRC service-deployment feature to be configured and the attacker to hold a man-in-the-middle position on that path (or control/spoof the SDX/SRC server), conditions that significantly limit real-world exposure; no public exploit has been identified at time of analysis. Juniper has issued patches in advisory JSA112187, and the vendor's CVSS 4.0 score of 9.3 is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1).
Remote code execution with root privileges or denial of service in Juniper Networks Junos OS on SRX Series devices is possible through a stack-based buffer overflow in the iked IKE key-management daemon. An authenticated remote-access VPN client on an SRX running affected Junos OS releases can exploit the remote-access VPN authentication and JIMS identity-publishing path; deployments not using remote-access VPN or JIMS identity publishing are not exposed. No public exploit code has been identified at time of analysis, but a vendor patch is available and the vendor CVSS score is 8.7 with high confidentiality, integrity, and availability impact.
Adjacent, unauthenticated code execution as root affects Juniper Junos OS and Junos OS Evolved devices that support Secure-ZTP when their phone-home daemon (phcd) processes a crafted DHCP SZTP bootstrap message. The flaw is a stack-based buffer overflow (CWE-121) that can be triggered by a network-adjacent attacker (CVSS 4.0 AV:A/AC:L/PR:N/UI:N, vendor score 8.7 High); no credentials or user interaction are required, but the target must be a Secure-ZTP-capable platform actively in the DHCP SZTP bootstrap/provisioning state and the attacker must be on the same Layer-2/logical segment. Vendor patches are available; no public exploit code or KEV-listed active exploitation was identified in the provided data.
Unauthenticated adjacent attackers can crash the routing protocol daemon (rpd) on Juniper MX Series devices running Junos OS and ACX Series devices running Junos OS Evolved by sending a malformed IGMPv3 membership report over a directly connected network, producing a denial of service. The defect is a NULL pointer dereference (CWE-476) reached while the device processes IGMPv3 membership traffic, so exploitation requires multicast/IGMP to be configured and active on the receiving interface, and it does not yield any confidentiality or integrity impact. Vendor-reported CVSS 4.0 base score is 7.1 (AV:A, PR:N, UI:N, VA:H), and there is no public exploit identified at time of analysis; a vendor patch is available per Juniper advisory JSA112187 (EUVD-2026-101386).
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, unauthenticated attacker who operates a rogue DHCP server execute arbitrary commands as root on affected EX Series, SRX Series, and QFX Series devices. Exploitation is not remotely routable: the attacker must share a Layer-2 broadcast domain with the target and the device must be actively running phone-home / zero-touch provisioning (ZTP), which is why an independent assessment rates the attack complexity higher than the vendor's 8.7 score despite the high confidentiality, integrity, and availability impact (PR:N/UI:N once those conditions hold). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV entry), though NVIDIA/ENISA EUVD tracking and a full Juniper advisory (JSA112187) with vendor patches indicate this is a genuinely high-priority, patchable issue.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-adjacent attacker to trip a reachable assertion in the bfdd daemon and restart it by sending crafted Bidirectional Forwarding Detection (BFD) session traffic. Only devices running an affected release train with BFD configured on at least one session are exposed, and the impact is confined to availability: repeated daemon restarts can disrupt BFD-based link-failure detection and slow routing convergence, but there is no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and the requirement that the attacker be on the same L2 segment or directly connected link (PR:N, AV:A) sharply limits the attacker population, making this a genuine but constrained availability risk rather than a top-tier emergency.
Stack-based buffer overflow in Juniper Networks Junos OS jdhcpd lets an unauthenticated adjacent attacker crash the DHCP client process with a crafted DHCP response, causing denial of service for DHCP, relay, and zero-touch-provisioning services on devices configured as DHCP clients. Exploitation requires L2 adjacency to the victim and no authentication or user interaction; devices not operating as DHCP clients are not exposed, and service recovers once malicious traffic stops. Vendor patches are available per Juniper advisory JSA112188, and no public exploit code has been identified at time of analysis.
An out-of-bounds read in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated attacker on the adjacent network crash the daemon and disclose limited process memory by sending a crafted Connectivity Fault Management (CFM) message to an interface with CFM configured. Affected releases span Junos OS 23.x through 26.2 and corresponding Junos OS Evolved branches, with fixes available per Juniper advisory JSA112187. Exploitation is bounded by the non-default requirement that CFM be configured on a reachable Layer 2 interface; no public exploit identified at time of analysis.
Stack-based buffer overflow in the cfmd process of Juniper Junos OS and Junos OS Evolved on MX Series and PTX Series platforms enables unauthenticated adjacent-network attackers to execute arbitrary code as root or cause denial of service when enhanced CFM mode and a configured down-MEP are present. The CVSS 8.7 score reflects high confidentiality, integrity, and availability impact, but real-world exposure is constrained by the non-default CFM/802.1ag configuration and the need for Layer 2 adjacency; no public exploit identified at time of analysis.
A stack-based buffer overflow in Juniper's jdhcpd process lets an adjacent, unauthenticated attacker crash or potentially achieve root-level code execution on Junos OS and Junos OS Evolved devices that are configured to use the DHCPv4 local-client feature. Exploitation requires the device to act as a DHCPv4 client and an attacker to sit on the same Layer 2 segment able to deliver a malformed DHCPv4 server response (for example via a rogue or spoofed DHCP server); there is no public exploit identified at time of analysis, but a vendor patch is available. Because jdhcpd runs with root privileges, a successful overflow could yield high confidentiality, integrity and availability impact, making this a mid-to-high priority issue for exposed deployments rather than a universal emergency.
Memory exhaustion in the Juniper Networks Junos OS and Junos OS Evolved l2cpd process allows an unauthenticated attacker on the same Layer 2 segment to disrupt Layer 2 control-plane operations by sending LLDP traffic, but only when the non-default LLDP fast-receive-processing feature is enabled. No authentication or user interaction is required, and the impact is limited to availability (CVSS 3.1 7.1, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity effect. A vendor patch is available through Juniper advisory JSA112187, and no public exploit code has been identified at time of analysis.
A stack-based buffer overflow in the l2cpd (Layer 2 Control Protocol daemon) of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated attacker who is Layer 2 adjacent - on the same broadcast domain or directly cabled to the target interface - crash Layer 2 control-plane processing by sending crafted LLDP packets to an interface with LLDP enabled. The primary outcome is denial of service: repeated triggering can destabilize LLDP and other Layer 2 control protocols on the device, though the assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, ~6.5) rates this as availability-only impact with no confidentiality or integrity loss. Exploitation is gated by two prerequisites - the attacker must already have local Layer 2 presence and the targeted interface must explicitly have LLDP configured - so remote Internet-based attacks are not possible; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and vendor patches are available.
Adjacent unauthenticated attackers can trigger a stack-based buffer overflow in the l2cpd process on Juniper Junos OS and Junos OS Evolved by sending crafted LLDP traffic to an interface configured with Unified Access Policy, potentially causing a denial of service or root-level code execution. Exploitation requires Layer-2 adjacency and the non-default UAP configuration, so this is a high-priority networking vulnerability rather than a universal emergency. No public exploit identified at time of analysis, and a vendor patch is available.
Denial of service in Juniper Networks Junos OS allows an attacker on an adjacent Layer 2 network segment to exhaust resources in the l2cpd (Layer 2 Control Protocol) process, causing the daemon to restart and disrupting Layer 2 control-plane services on the affected device. The attack is unauthenticated and requires no user interaction, but is only reachable when the FNP feature is enabled on a VPLS routing instance that also has VLAN-VPLS encapsulation configured - a specific, non-default deployment that limits exposure; remote internet-based exploitation is not possible. All Junos OS platforms are potentially affected except the PTX Series and SRX Series, and no public exploit code or confirmed active exploitation was identified at time of analysis (the issue is not listed in CISA KEV), though a vendor patch is available.
A crafted MVRP Ethernet frame sent to an MVRP-enabled interface can crash or disrupt the l2cpd Layer 2 control-protocol daemon in Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service for associated Layer 2 control protocols. Only devices with MVRP (Multiple VLAN Registration Protocol) explicitly enabled on at least one interface, and reachable from the same Layer 2 broadcast domain, are exposed - MVRP is not enabled by default, so the vast majority of deployments are not at risk. No authentication or user interaction is required, but the attacker must have Layer 2 adjacency; the frame cannot be delivered across a Layer 3 boundary or over the internet. Scoring is AV:A with high availability impact only (C:N/I:N per the independent CVSS 3.1 assessment); there is no public exploit identified at time of analysis.
Crafted SCTP network traffic can drive the netsctp.ko kernel module on Juniper MX Series routers running affected Junos OS releases into an infinite loop, stalling the SCTP processing path and producing a denial of service against the device. Exploitation is unauthenticated and requires no user interaction (PR:N/UI:N per the assessed vector) - the attacker only needs network reachability to a device that is actually processing SCTP traffic, which in practice means MX platforms used in telecom/mobile signaling roles; routers that do not handle SCTP are not exposed. The vendor has published an advisory and fixed releases, and no public exploit code or confirmed active exploitation was identified at time of analysis (this CVE is not associated with CISA KEV), so the primary risk driver is the size of the exposed, SCTP-handling MX population rather than demonstrated in-the-wild abuse.
An out-of-bounds write (CWE-787) in the lacpd daemon of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to crash the device - a denial of service - by sending a crafted frame to an aggregated-Ethernet member port that has LACP enabled. The attacker needs no authentication or user interaction (PR:N/UI:N) and must be positioned on the same local broadcast domain or directly attached to the member port (AV:A), so this is not an internet-reachable flaw; impact is availability-only (VC:N/VI:N/VA:H, with low subsequent-system availability impact SA:L in the CVSS 4.0 vector, assessed as CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The independent assessment rates this as a genuine but bounded operational risk rather than an emergency: exposure depends entirely on LACP being configured on an AE member port, and no public exploit has been identified at time of analysis (the CVE is not listed in CISA KEV, and no POC is referenced in the available intelligence).
The Juniper Junos OS routing process (rpd) can be crashed by a configured BGP-LS peer sending a specially crafted BGP-LS update, resulting in a denial of service. This reachable assertion vulnerability (CWE-617) affects Junos OS and Junos OS Evolved only when BGP-LS is configured and a peering session is established, requiring the attacker to be an already-trusted, configured BGP-LS peer. No public exploit code or active exploitation has been identified at the time of analysis, but the CVSS score of 8.7 reflects the high availability impact.
An adjacent attacker positioned on the MPLS-TE signaling plane can crash the rpd routing process on Juniper Networks Junos OS and Junos OS Evolved by way of a numeric truncation error (CWE-197) triggered during MPLS-TE fast-reroute signaling, producing a denial of service against the affected router's control plane. Juniper scores this 7.1 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L); our independent assessment maps it to CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, i.e. a high-availability-only impact. Exploitation requires MPLS-TE with fast-reroute (FRR) signaling configured and an attacker able to source or influence that signaling from an adjacent network position - no authentication or user interaction is needed, but default configurations without MPLS-TE FRR are not exposed. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the adjacency plus feature-configuration prerequisites confine realistic exposure largely to service-provider and large-enterprise MPLS cores.
Adjacent, unauthenticated attackers can crash the routing process (rpd) in Juniper Networks Junos OS and Junos OS Evolved by sending crafted RSVP-TE associated-bidirectional LSP signaling messages, resulting in a denial-of-service condition. This reachable assertion (CWE-617) requires the target device to be configured for RSVP-TE with associated-bidirectional LSP signaling and the attacker to be network-adjacent, meaning they must have an RSVP-TE signaling relationship or adjacency to the device. No public exploit identified at time of analysis, and the impact is limited to availability with automatic recovery, not code execution or data exposure.
Malformed RSVP signaling can trip a reachable assertion inside the rpd routing daemon on Juniper Networks Junos OS and Junos OS Evolved, terminating the daemon and causing a denial of service on the affected device. The flaw is exploitable without authentication or user interaction by an attacker positioned on an adjacent network segment (CVSS 4.0 base 7.1; AV:A/PR:N/UI:N with high availability impact), but only when RSVP signaling is actually enabled - typically MPLS traffic-engineering deployments - so devices without RSVP configured are not exposed. At time of analysis there is no public exploit identified and no CISA KEV listing; the practical risk is a bounded availability issue against the control plane rather than a confidentiality or integrity compromise, with JSA112187 as the sole authoritative vendor source.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent, unauthenticated attacker to crash the rpd routing daemon by sending a crafted RSVP Path message, disrupting routing on the affected device (CVSS 7.1; assessed CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, availability-only impact). Exploitation is bounded: the target must have RSVP signaling enabled (typically for MPLS traffic engineering / LSP setup) and the attacker must be reachable at Layer 2 or act as a directly-connected routing neighbor able to inject RSVP control traffic, so arbitrary internet-based attackers are excluded. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the low attack complexity and the unauthenticated nature of the vector make the flaw attractive to anyone already inside the adjacency or peering domain.
A malformed RSVP Path message sent over an EVPL LMP control channel can dereference a NULL pointer in the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd), crashing the process and causing a denial of service. Network-adjacent attackers with Layer 2 reachability to the control channel can trigger the crash without authentication or user interaction, though only devices explicitly configured for EVPL service with an LMP control channel are exposed - a non-default configuration. No public exploit has been identified at time of analysis, and the independent assessment characterizes this as a moderate-severity, targeted availability issue rather than a top-tier emergency.
XML injection in the Unified Threat Management daemon (utmd) of Junos OS on SRX Series devices allows an unauthenticated network attacker to push arbitrary Junos device configuration that the daemon then commits with root privileges, by serving a crafted XML response from a configured custom URL-feed server. Exploitation is not opportunistic: the SRX must be running UTM with a custom URL-category feed pointed at an attacker-influenced server, and the attacker must either control that feed server or be positioned to intercept and modify its response (a MITM), which is why the vendor's CVSS 4.0 score of 9.2 sits alongside an independent assessed vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Impact is total on exposed devices - full confidentiality, integrity and availability loss on the affected SRX - but no public exploit has been identified at time of analysis and there is no confirmed active exploitation. Treat it as a genuine high-priority issue rather than an inflated high-CVSS artifact, and prioritize any SRX running a custom URL-feed.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved: the Layer 2 address learning daemon (l2ald) contains an integer overflow/wraparound (CWE-190) that can be triggered by a crafted EVPN Type-2 (MAC/IP) route advertisement, causing the process to fail and disrupting EVPN-based Layer 2 forwarding. Affected are devices running EVPN with an established, configured BGP peering session; the attacker must control one of those configured EVPN BGP peers, so exposure is limited to environments where EVPN is deployed and peer trust is not strictly enforced. CVSS 8.7 (CVSS 4.0) and 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV). This is a credible operational priority for networks running EVPN, though not a mass-exploitation threat.
Adjacent unauthenticated attackers can cause a denial of service in Juniper Junos OS and Junos OS Evolved by sending a crafted ICCP peer message to the l2ald process, provided MC-LAG IRB MAC synchronization is enabled. The reachable assertion (CWE-617) crashes the l2ald daemon, affecting availability; this is a conditional DoS requiring a non-default MC-LAG configuration and adjacency to the inter-chassis control link. No public exploit identified at time of analysis; EPSS data not provided.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by a malformed MC-LAG message sent to the l2ald daemon, causing a reachable assertion failure and daemon crash. Only devices explicitly configured for MC-LAG with ICCP peering enabled are affected, and the attacker must hold the network position of a configured ICCP peer (adjacent Layer 2 access). No public exploit code or active exploitation has been identified; the issue is availability-only with no confidentiality or integrity impact.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by an adjacent attacker sending a crafted ICCP MC-LAG message to l2ald, causing the daemon to mishandle a specified quantity field. The flaw only affects devices configured for MC-LAG with ICCP active and the attacker must be on the Layer-2 adjacency or ICCP peering path; no authentication or user interaction is required once that adjacency is achieved, and impact is availability-only (no data exposure or code execution). No public exploit identified at time of analysis, and the independent assessment rates this as a genuine but situational priority rather than a top-tier emergency because the non-default MC-LAG/ICCP prerequisite and adjacency constraint sharply reduce the realistic attacker population.
Memory exhaustion in the l2ald (Layer 2 address learning) daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a denial of service against the device by sending crafted packets, but only when the non-default static MAC-IP EVPN feature is configured. The flaw is tracked as CWE-401 (Missing Release of Memory after Effective Lifetime), meaning the daemon fails to free memory it has allocated, so repeated crafted traffic can drain resources and disrupt the l2ald process; per the assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) impact is availability-only and the attacker must sit on the same Layer-2 segment as the target. No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is limited because the static MAC-IP feature is not enabled by default and routed/remote attackers cannot reach the vulnerable path.
Authenticated, low-privileged TACACS+ users on Juniper Networks Junos OS Evolved can escalate to root and execute arbitrary OS commands, but only when the periodic TACACS+ authorization-refresh feature is enabled - an OS command injection flaw (CWE-78) that requires both a valid low-privileged TACACS+ account and that specific configuration to be active. The vendor rates it 9.3, while our independent assessment scores it CVSS:3.1 9.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting that exploitation is not possible by an anonymous remote attacker despite the vendor's PR:N vector. There is no public exploit identified at time of analysis, and the flaw does not trigger on devices using TACACS+ without authorization-refresh, or on devices using RADIUS or local authentication.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved affects the rpd routing process, which can be disrupted when a configured MVPN neighbor sends a crafted BGP MVPN update to a device running a non-default inter-region segmented VRF configured with 'protocols mvpn inter-region-template'. Exposure is narrow but real: the target must have that specialized multicast-VPN configuration and an established BGP MVPN peering relationship with the sender, and the CVSS 4.0 vector is unauthenticated (PR:N) with network reachability. Impact is availability-only (rpd disruption with automatic recovery, no confidentiality or integrity loss), the base score is 8.7 High with a low subsequent-system availability effect (SA:L) indicating a scope-crossing impact on routing, and no public exploit code or confirmed active exploitation is identified at time of analysis.
A NULL pointer dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved crashes the daemon and causes a denial of service when a routing policy that uses AS-path expansion is evaluated against MSDP or PIM data. Exploitation is constrained by non-default configuration: the device must have MSDP or PIM enabled together with an AS-path-expansion policy, and the attacker must either already be a configured MSDP peer or be an adjacent PIM sender able to inject PIM messages. Juniper rates the 4.0 base score at 8.7 with network reach, low complexity, and PR:N per the vector, but the real limiting factors are positional (established peering or adjacency) and configuration-specific rather than arbitrary-internet reachable; impact is availability only, with no data exposure, integrity loss, or code execution, and no public exploit identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved arises when the routing protocol daemon (rpd) dereferences a NULL pointer while processing multiple BGP UPDATE messages delivered over a single TCP session, but only with the non-default 'bgp family l2vpn auto-discovery-only' BGP family configured. A remote BGP peer can crash rpd and interrupt routing services on the affected device; the daemon recovers, and there is no confidentiality or integrity impact. Exploitation requires an already-established, configured BGP adjacency rather than arbitrary internet access, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Malformed BGP labeled-unicast UPDATE messages can crash the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on affected routers (CVSS 8.7). Per the vendor CVSS vector the attack is unauthenticated (PR:N), but exploitation in practice requires two concrete preconditions: the sender must be a configured eBGP neighbor with an established BGP peering session to the target, and the affected BGP multipath features must be enabled on the router, with the trigger arriving as labeled-unicast UPDATEs. Impact is availability only - rpd crashes with no confidentiality or integrity effect - and no public exploit code has been identified at time of analysis, so this is primarily an operational-availability risk for Juniper networks that peer eBGP with external or less-trusted parties and run multipath.
A crafted BGP route update sent by an adjacent eBGP peer can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved devices that have RIB sharding enabled, producing a denial-of-service condition affecting routing availability. Per the independent assessment, exploitation requires two non-trivial preconditions: RIB sharding must be explicitly configured (it is not a default setting), and the attacker must already hold an established eBGP peering session with the target; the assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is unauthenticated but adjacent, with availability-only impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a high-severity but condition-gated DoS rather than a code-execution or data-exposure flaw; devices without RIB sharding or peering only with trusted neighbors are not realistically exposed.
Juniper Networks Junos OS and Junos OS Evolved can have their routing protocol daemon (rpd) crashed by a crafted BGP route update, producing a routing-layer denial of service on devices that combine extended next-hop tunneling with SRv6 service processing. Only deployments with both of these non-default, service-provider-oriented features active are exposed, and the traffic must arrive over an established BGP peering session, so real-world exposure is narrow; the impact is availability-only with no confidentiality or integrity loss. No public exploit code and no CISA KEV entry were identified at time of analysis, and the referenced Juniper advisory (JSA112187) is the authoritative source for affected versions.
Crafted BGP route updates sent by an established BGP peer can trigger an integer overflow in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved, crashing the process and causing a denial of service. The flaw is only reachable when the non-default extended-nexthop-tunnel feature is explicitly enabled on the target device, and the attacker must already hold a configured BGP peering relationship with the device, meaning a trusted routing position is a prerequisite rather than anonymous internet exposure. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor CVSS 4.0 score of 8.7 reflects high availability impact on the local system with no confidentiality or integrity exposure; note that the vendor vector lists PR:N while the vendor's own description and our assessment specify an authenticated BGP peer, a conflict that should be resolved using the description's authentication requirement.
Denial of service in Juniper Networks Junos OS Evolved can be triggered by a crafted SNMP query to the firewall-counter MIB, causing the fwstatsd daemon to hit a reachable assertion and terminate, which disrupts device availability when at least one firewall counter is configured. The advisory describes an authenticated network attacker and the independent assessment's CVSS 3.1 vector (PR:L) reflects an authenticated prerequisite, while the supplied CVSS 4.0 vector lists PR:N, an inconsistency that should be verified against Juniper's advisory. No public exploit code or active exploitation has been identified at time of analysis.
A crafted BGP-LS Link NLRI advertisement sent over an established BGP-LS peering session can trigger a reachable assertion inside the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved, causing rpd to crash and disrupting the device's routing control plane. Impact is limited to availability - no code execution, data disclosure, or integrity impact occurs - and only devices explicitly configured with BGP-LS and peered with the attacker's BGP-LS speaker are exposed, meaning the attacker must occupy or control one of the operator-provisioned BGP-LS peers. This is a credible operational-risk denial-of-service issue rather than a code-execution or data-breach threat; no public exploit code identified at time of analysis, and vendor patches are available per Juniper advisory JSA112187.
A NULL pointer dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker on an adjacent network to terminate the daemon and disrupt routing protocol sessions by sending a crafted RSVP packet when MPLS-TE RSVP processing is enabled; the flaw carries a CVSS v4.0 base score of 7.1 (CVSS:3.1 equivalent AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects availability only, with no confidentiality or integrity impact. Exposure is bounded by two prerequisites - the device must actually be configured for RSVP-TE/MPLS-TE signaling, and the attacker must sit on the same L2 segment, directly connected link, or adjacent routing/peering domain rather than being reachable from the open internet. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (not listed in CISA KEV); EPSS data was not provided in the available intelligence.
Denial of service affecting the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved is triggered when crafted or malformed BGP-LS (BGP Link-State) routing updates hit a reachable assertion in the daemon, causing it to terminate. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the attacker must hold a valid, authenticated BGP peering session with the target and the device must be configured for BGP-LS; devices that do not run BGP-LS, or that peer only with trusted and uncompromised neighbors, are not realistically exposed. Impact is confined to availability of the rpd process with automatic recovery, no confidentiality or integrity impact applies, no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Malformed RIPv2 messages delivered to the routing protocol daemon (rpd) can crash or otherwise disrupt routing on Juniper Networks Junos OS and Junos Evolved, producing a denial-of-service condition. Exploitation requires the attacker to be network-adjacent (same link or broadcast domain) and requires that RIPv2 be actively configured and enabled on the target; no authentication or user interaction is needed, and the impact is availability-only, with no confidentiality or integrity effect. The issue is rated CVSS 7.1 (CVSS 4.0 basis) and CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, making this a moderate-risk availability issue rather than a top-tier emergency.
A NULL pointer dereference in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker positioned on an adjacent Layer 2 segment or as a multicast/routing peer to crash the routing protocol process by sending a malformed PIM Bidirectional (Bidir) message, producing a denial-of-service condition (CVSS 7.1). Exposure is gated by configuration: the target device must be running PIM Bidir, a non-default multicast feature, which means only networks actively deploying bidirectional PIM are at risk, and the attacker must be able to deliver a PIM packet directly to rpd rather than across arbitrary routed networks. Impact is confined to availability of the routing control plane - no code execution, data disclosure, or configuration integrity impact - and there is no public exploit identified at time of analysis.
Denial of service in the Juniper Junos OS rpd routing process is possible when the non-default Auto-RP mapping feature is enabled, allowing an unauthenticated attacker on an adjacent network segment to send crafted Auto-RP mapping announcements that trigger an out-of-bounds write (CWE-787) and crash the routing plane. Juniper rates this CVSS 4.0 7.1, and our independent assessment concurs it is a moderate-priority availability issue rather than a critical emergency; no public exploit code or CISA KEV entry was identified at time of analysis. The attacker must be within the PIM multicast domain and cannot reach the device from the general internet.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered when the routing protocol daemon (rpd) fails to properly validate a quantity field carried in a BGP MVPN (Multicast VPN) signaling update, allowing the crafted message to disrupt rpd and impair routing on the affected device. Exploitation is constrained by a strong precondition: the target must be configured for BGP MVPN signaling, and the sender must be - or must impersonate - an already configured, established BGP MVPN peer, so exposure is limited to the BGP MVPN peering trust boundary rather than arbitrary internet hosts. Impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 score 8.7), with supplemental metrics indicating automatic recovery; no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Heap-based buffer overflow in the secure-dot1xd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service by sending a crafted EAPOL frame to an 802.1X-authenticated interface. Exploitation requires the targeted interface to be configured for 802.1X port-based authentication and Layer 2 adjacency, and no public exploit has been identified at time of analysis. With a CVSS 4.0 score of 8.7, this is a high-priority flaw for affected deployments using 802.1X.
Stack-based buffer overflow in the authd process of Juniper Networks Junos OS allows an attacker who can influence a configured RADIUS server to crash the device or execute arbitrary code with root privileges. This unauthenticated, adjacent-network attack (CVSS 8.7) is limited to devices that have RADIUS authentication enabled and where the attacker either controls the RADIUS server or can inject or modify RADIUS responses on the adjacent network. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed (not in CISA KEV).
Remote, unauthenticated attackers can crash the na-grpcd daemon on Juniper Networks Junos OS Evolved by sending a crafted gRPC telemetry subscription request, causing a denial of service. This affects devices where the gRPC telemetry subscription service is enabled and reachable; no public exploit code is known, and the process restarts automatically, limiting outage duration. The CVSS 4.0 score is 8.7 (High), while the independent assessment rates availability impact as High (CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Adjacent Layer-2 attackers can crash the rpd routing daemon on Juniper Networks Junos OS and Junos OS Evolved devices that run LDP across a link-protected interface, producing a denial of service when two misconfigured LDP neighbors - or a single neighbor duplicated by an L2 loop - advertise the same transport address and trip an internal assertion in the daemon. The CVSS vector (AV:A/PR:N, no confidentiality or integrity impact) shows the attack is unauthenticated but requires link adjacency plus an established LDP session and a non-default misconfiguration or L2 loop, so exposure is conditional rather than universal and is confined to availability; recovery is assessed as automatic (R:A) because the daemon restarts after the crash. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS-style urgency signals in the supplied data do not indicate mass scanning or confirmed in-the-wild abuse.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved results from a reachable assertion (CWE-617) in the rpd routing process that can be triggered by adjacent unauthenticated attackers sending LDP control traffic. Devices with Label Distribution Protocol (LDP) configured and active are exposed; the attacker must be on the same Layer 2 segment or directly connected link, but no authentication or user interaction is required. No public exploit code has been identified, and CISA KEV does not list this vulnerability as actively exploited.
A reachable-assertion flaw in the Juniper Junos OS and Junos OS Evolved rpd routing daemon lets a network-adjacent attacker crash the daemon by sending a crafted LDP Label message that carries an IPv6 Prefix FEC, producing a denial-of-service condition (CVSS 4.0 base 7.1; availability-only). The attacker must already share an L2 segment or act as a directly connected routing peer and must have an established LDP session with the target, so only devices with LDP configured and actively exchanging IPv6 Prefix FEC bindings are exposed; no authentication or user interaction is required once that adjacency exists (PR:N, UI:N), and the daemon's automatic restart bounds each outage. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); impact is limited to availability, with no confidentiality or integrity effect.
Juniper Junos OS and Junos OS Evolved devices that run OSPFv3 on a broadcast interface can be crashed by an unauthenticated adjacent attacker who sends specially crafted OSPFv3 protocol messages to the rpd routing daemon, producing a denial of service and heap memory corruption. Exploitation requires only Layer-2 adjacency to the affected broadcast segment and no credentials or user interaction, but devices that do not run OSPFv3, or that use point-to-point interface types, are not exposed; no public exploit code has been identified at time of analysis. Vendor severity is moderate (CVSS 4.0 7.1) with an availability-only impact, aligning with our independent CVSS 3.1 assessment of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Adjacent, unauthenticated attackers can crash the rpd routing protocol daemon on Juniper Networks Junos OS and Junos OS Evolved devices that are configured for sparse-mode PIM, exploiting a use-after-free flaw triggered by specific PIM Join/Prune messages. Successful exploitation causes a denial of service through daemon failure and subsequent routing churn, with no impact on confidentiality or integrity. Exploitation is conditional: the target must run PIM sparse mode and the attacker must already sit on an adjacent multicast/routing segment with a valid PIM adjacency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor advisory JSA112187 is the authoritative source for affected and fixed releases.
Malformed PIM Hello messages can crash the rpd process in Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on IPv6-enabled PIM interfaces. This improper input validation flaw (CWE-20) is exploitable by an unauthenticated adjacent attacker (AV:A) without user interaction, but requires PIM to be configured and the target interface to be IPv6-enabled. No public exploit code or active exploitation is known; the CVSS 4.0 base score is 7.1, and independent assessment classifies this as a moderate-severity availability issue with a bounded exposed population.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker who already holds an established EVPN BGP peering relationship with a target device to disrupt the routing protocol daemon (rpd) by sending EVPN BGP routes that trigger an integer overflow or wraparound. The flaw affects EVPN-enabled routing instances and can tear down control-plane adjacencies and halt route processing, producing an availability-only impact with no confidentiality or integrity effect. EVPN is a deliberately configured, non-default feature and the peering trust relationship must pre-exist, so realistic exploitation is limited to EVPN deployments and adjacent or compromised BGP peers; no public exploit code was identified at time of analysis, and the vendor advisory is Juniper JSA112187.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, peer-trusted attacker to crash the routing protocol daemon (rpd) by sending specially crafted EVPN route updates. Exploitation requires an established, accepted EVPN BGP peering session with the attacker controlling or compromising the peer endpoint; routers without EVPN/BGP signaling configured or without the attacker in their accepted-peer set are not exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis; risk is limited to availability (no confidentiality or integrity impact), but the flaw is a genuine operational priority for networks running EVPN.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-positioned attacker to disrupt the routing protocol daemon (rpd) by delivering a crafted BGP EVPN update message. Affected releases include multiple Junos OS and Junos OS Evolved versions, but exposure requires that BGP with the EVPN address family be configured - a non-default setting typical of EVPN-VXLAN data center fabrics - and the attacker must be able to reach rpd over an established BGP EVPN session (a configured peer or an on-path attacker on the peering path). Impact is availability-only (control-plane DoS) with no confidentiality or integrity exposure; no public exploit identified at time of analysis, and vendor patches are available.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered in the routing protocol daemon (rpd) by a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. The vendor rates this 8.7, while independent assessment maps it to high availability impact (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss; the practical precondition is an established EVPN peering relationship, so an arbitrary internet host is not sufficient despite the unauthenticated CVSS vector. No public exploit code or CISA KEV active exploitation is identified in the provided data at time of analysis, and affected deployments are those running EVPN on unpatched Junos OS or Junos OS Evolved releases.
Denial of service in Juniper Junos OS and Junos OS Evolved rpd allows a configured BGP neighbor to crash the routing protocol daemon by sending a crafted BGP route update when both resolution-map routing policy and policy event-tracing are enabled. The flaw is a NULL pointer dereference (CWE-476) affecting multiple release trains; exploitation requires the non-default combination of those two features and an existing BGP peering relationship, so baseline or non-peered devices are not exposed. Juniper has released patches via advisory JSA112187, and no public exploit identified at time of analysis.
A NULL pointer dereference in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated, already-configured BGP peer crash the routing process by sending a crafted BGP UPDATE, producing a denial of service, but only on devices where both ISO-VPN and egress-protection are enabled - a non-default feature combination. The CVSS 4.0 vector scores 8.7 (High) and is driven entirely by availability impact (VC:N/VI:N/VA:H/SC:N/SI:N/SA:L), with no confidentiality or integrity loss. No public exploit code and no confirmed active exploitation were identified at time of analysis; arbitrary Internet hosts cannot reach the vulnerable code path because the sender must already be an operator-configured BGP peer of the target device.