Juniper Networks vulnerabilities
1,066 vulnerabilities
Known vulnerabilities in Juniper Networks products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 50 products.
Products
50- Junos OS817 vulnerabilities
- Junos OS Evolved373 vulnerabilities
- Junos Space49 vulnerabilities
- Northstar Controller Application19 vulnerabilities
- Juniper ATP12 vulnerabilities
- Screenos7 vulnerabilities
- Contrail Service Orchestration5 vulnerabilities
- Paragon Active Assurance5 vulnerabilities
- Junos Space Security Director3 vulnerabilities
- MIST Cloud UI3 vulnerabilities
- SRC Series3 vulnerabilities
- Contrail2 vulnerabilities
- JSI LWC2 vulnerabilities
- SBR Carrier2 vulnerabilities
- Session Smart Conductor2 vulnerabilities
- Session Smart Router2 vulnerabilities
- 128 Technology Session Smart Router1 vulnerabilities
- Appformix1 vulnerabilities
- Appid Service Sigpack1 vulnerabilities
- Apstra1 vulnerabilities
- Contrail Cloud1 vulnerabilities
- Contrail Insights1 vulnerabilities
- Contrail Networking1 vulnerabilities
- CTP OS1 vulnerabilities
- Ctpview1 vulnerabilities
- JATP1 vulnerabilities
- JDPI Decoder Engine1 vulnerabilities
- Juniper Identity Management Service1 vulnerabilities
- Juniper Identity Management Service (Jims)1 vulnerabilities
- Juniper Networks NFX Series Network Services Platform1 vulnerabilities
- Juniper Security Director1 vulnerabilities
- Junos1 vulnerabilities
- Junos OS On EX Series Ethernet Switches With Ipv6 Enabled1 vulnerabilities
- Junos OS On M/MX Platforms Where Enhanced Subscriber Management For Dhcpv6 Subscribers Is Configured1 vulnerabilities
- Junos OS On SRX Series Services Gateways Chassis Cluster1 vulnerabilities
- Junos OS Running On Qfx3500, Qfx3600, Qfx5100, Qfx5200, Ex4300, Ex4600 Devices1 vulnerabilities
- Junos OS Where RIP Is Enabled1 vulnerabilities
- Junos OS Where The BGP Add Path Feature Is Enabled With 'Send' Option Or With Both 'Send' And 'Receive' Options1 vulnerabilities
- Junos OS With BGP Enabled1 vulnerabilities
- Junos OS With Dhcpv6 Enabled1 vulnerabilities
- Junos OS With LDP Enabled1 vulnerabilities
- Junos Snapshot Administrator (Jsnapy)1 vulnerabilities
- Junose1 vulnerabilities
- Paragon Active Assurance (Formerly Netrounds)1 vulnerabilities
- Paragon Automation (Pathfinder, Planner, Insights)1 vulnerabilities
- Security Director Policy Enforcer1 vulnerabilities
- Service Insight1 vulnerabilities
- Service Now1 vulnerabilities
- WAN Assurance Managed Router1 vulnerabilities
- WAN Assurance Router1 vulnerabilities
CVE-2026-33798juniper networksjunos os+1
EPSS score0.35%
A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic.CVE-2026-33796juniper networksjunos os+1EPSS score0.56%
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.CVE-2026-33795juniper networksjunos os+1EPSS score0.37%
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised.
This issue does not affect versions of Junos OS prior to 20.4R1.
This issue does not affect versions of Junos OS Evolved prior to 20.4R1-EVOCVE-2026-33792juniper networksjunos osEPSS score0.61%
A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.CVE-2026-33789juniper networksjunos os+1EPSS score0.69%
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.CVE-2026-102185juniper networksjunos os+1EPSS score0.37%
A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election.CVE-2026-102184juniper networksjunos os+1EPSS score0.46%
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update. The result is a denial of service affecting routing adjacencies.CVE-2026-102183juniper networksjunos os+1EPSS score0.46%
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP EVPN peer to cause an rpd crash via a specifically malformed NLRI.CVE-2026-102182juniper networksjunos osEPSS score0.41%
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.
This issue affects Junos OS on MX Series:
* All versions before 21.2R3-S11;
* from 21.4 before 21.4R3-S12;
* from 22.2 before 22.2R3-S8;
* from 22.3 before 22.3R3-S5;
* from 22.4 before 22.4R3-S9;CVE-2026-102077juniper networksjunos osEPSS score0.34%
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resource exhaustion, which will impact all traffic through the device. To recover the device needs to be rebooted.
To monitor session usage, use the following:
show services sessions summary
To monitor source NAT resource usage, use the following:
show services nat pool
This issue affects Junos OS on MX Series with SPC3:
* All versions before 23.2R2-S4;
* 23.4 versions before 23.4R2-S5;
* 24.2 versions before 24.2R2.CVE-2026-101983juniper networksjunos os+1EPSS score0.54%
A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.CVE-2026-101982juniper networksjunos os+1EPSS score0.57%
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.CVE-2026-101981juniper networksjunos os+1EPSS score0.24%
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.CVE-2026-101979juniper networksjunos os+1EPSS score0.45%
A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled.CVE-2026-101976juniper networksjunos os+1EPSS score0.46%
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS).CVE-2026-101975juniper networksjunos os+1EPSS score0.18%
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured.CVE-2026-101972juniper networksjunos os+1EPSS score0.27%
An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface.CVE-2026-101964juniper networksjunos os+1EPSS score0.25%
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session.CVE-2026-101963juniper networksjunos os+1EPSS score0.45%
An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.CVE-2026-101962juniper networksjunos os+1EPSS score0.38%
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash.