Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 189

Export CSV
CVE-2026-101967

Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used

An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.

CVSS 4.0 · 9.3 Critical EPSS 3.9% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Evolved
CVE-2026-101986

Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution

An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Juniper Juniper Networks
Products
Junos Junos Os Evolved Junos Os and 1 more
CVE-2026-101990

Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Juniper Juniper Networks
Products
Junos Junos Os Evolved Junos Os and 1 more
CVE-2026-101974

Junos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclosure or service disruption when link-local TE processing is used

An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-101987

Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is used

An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service by sending a specific IS-IS SRv6 packet when SRv6 and Flexible Algorithm are enabled.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-101968

Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd heap memory disclosure when Rosen-MVPN data-MDT is enabled

An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory disclosure and multicast join-state injection via a malformed Rosen-MVPN message. This issue only affects platforms that support draft Rosen MVPN, such as the ACX Series, EX Series, and MX Series.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-101976

Junos OS and Junos OS Evolved: In a non-4byte-AS scenario a specific BGP update causes an rpd crash

An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-101971

Junos OS and Junos OS Evolved: An attacker causes routing protocol daemon crash when OSPFv3 is enabled

An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service and heap memory corruption via OSPFv3 messages on an enabled broadcast interface.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-101999

Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled

A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session carrying an IPv6 Prefix FEC in a specific Label message.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-33789

Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in denial of service

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-33795

Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP Prefix-SID routes are re-advertised

A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised. This issue does not affect versions of Junos OS prior to 20.4R1. This issue does not affect versions of Junos OS Evolved prior to 20.4R1-EVO

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-33796

Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-33798

Junos OS and Junos OS Evolved: SRX Series: An attacker causes remote code execution when SRX chassis-cluster is enabled

A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-101966

Junos OS Evolved: A crafted analytics sensor resource causes telemetry dial-out daemon denial of service

A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Evolved
CVE-2026-103993

Junos OS and Junos OS Evolved: If a specific set of BGP communities is present and graceful-shutdown sender is added while attempting to advertise rpd crashes

An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker which sends a specific set of BGP communities to cause a Denial-of-Service (DoS) as rpd crashes when graceful-shutdown sender community is added when attempting to advertise.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-101996

Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash when MC-LAG is configured

A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-101938

Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used

An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-101939

Junos OS and Junos OS Evolved: A routing-policy table reference causes routing-daemon denial of service when source-based forwarding is used

A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table <X>` is configured to reference a routing table that does not exist.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-101969

Junos OS and Junos OS Evolved: An unauthenticated attacker causes rpd denial of service when IPv6 PIM is enabled

An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-101970

Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used

A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved