Juniper Networks Junos OS vulnerabilities, page 3
817 vulnerabilities
Known vulnerabilities in Juniper Networks Junos OS, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-101980juniper networksjunos os
EPSS score0.47%
An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.CVE-2026-101977juniper networksjunos os+1EPSS score0.46%
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent routing-daemon denial of service via a specific BGP packet when ephemeral configuration is used.CVE-2026-101974juniper networksjunos os+1EPSS score0.25%
An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets.CVE-2026-101973juniper networksjunos osEPSS score0.36%
A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment.CVE-2026-101957juniper networksjunos os+1EPSS score0.55%
An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group.CVE-2026-101956juniper networksjunos osEPSS score0.75%
An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.CVE-2026-101951juniper networksjunos os+1EPSS score0.46%
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent configured BGP peer to cause a denial of service by sending a specifically malformed BGP MCAST-TREE update and this NLRI is then attempted to be readvertised.CVE-2026-101948juniper networksjunos os+1EPSS score0.46%
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a denial of service via a specific BGP FlowSpec update received by an affected BGP session.CVE-2026-102082juniper networksjunos osEPSS score0.34%
An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS).
This issue is will occur when 'ssl-proxy' is configured on SRX platforms and during a TLS session-resumption attempt a specifically malformed TLS message is received. This results in an invalid pointer access and PFE crash which causes a temporary loss of traffic forwarding until the PFE automatically recovers. The exact internal timing to trigger this issue is outside the attacker's direct control.This issue affects Junos OS on SRX Series:
* All versions before 23.2R2-S5;
* 23.4 versions before 23.4R2-S5;
* 24.2 versions before 24.2R2-S2;
* 24.4 versions before 24.4R2.CVE-2026-102081juniper networksjunos osEPSS score0.37%
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).
On SRX4000 Series, and SRX5000 Series with SPC3, and MX Series with SPC3, when one or more specific application services like ALGs, IDP/DPI, APPID, SECINTEL, AAMW or AppQoE are configured, a high connections per second churn will cause PFE memory to leak. If the memory is exhausted traffic processing will be impacted.
Use the CLI command show security monitoring to monitor the memory utilization of the PFEs on the FPCs.
This issue affects Junos OS on SRX Series and MX Series:
* 23.4 versions from 23.4R2-S3 before 23.4R2-S7;
* 24.2 versions from 24.2R2 before 24.2R2-S3;
* 24.4 versions before 24.4R2-S3;
* 25.2 versions before 25.2R1-S2, 25.2R2.CVE-2026-102080juniper networksjunos osEPSS score0.18%
An Improper Resource Locking vulnerability in the clock synchronization daemon (clksyncd) of Juniper Networks Junos OS on MX Series allows a unauthenticated, logically adjacent attacker to cause a Denial-of-Service (DoS).
If a SyncE or PTP upstream node sends a malformed message to an MX device equipped with SCBE3, a false 19.44MHz alarm is generated on the master RE. This leads to persistent RE switchovers and a clksyncd process crash. This issue is outside the attacker's direct control as it's a race condition.
This issue affects Junos OS on MX Series:
* All versions before 23.2R2-S7.7;
* 23.4 versions before 23.4R2-S8.13;
* 24.2 versions before 24.2R2-S5.5;
* 24.4 versions before 24.4R2-S4;
* 25.2 versions before 25.2R2-S1;
* 25.4 versions before 25.4R1-S2.CVE-2026-102079juniper networksjunos osEPSS score0.66%
An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device.
A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification.
This issue affects Junos OS:
* 24.4 versions before 24.4R2-S4;
* 25.2 versions before 25.2R2-S1;
* 25.4 versions before 25.4R1-S3;
This issue does not affect Junos OS releases before 24.4R1.CVE-2026-102078juniper networksjunos osEPSS score0.33%
A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control.
This issue affects Junos OS on SRX Series:
* All versions before 23.2R2-S5;
* from 23.4 before 23.4R2-S6;
* from 24.2 before 24.2R2-S3;
* from 24.4 before 24.4R2-S1;
* from 25.2 before 25.2R1-S1, 25.2R2.CVE-2026-102071juniper networksjunos os+1EPSS score0.27%
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet.CVE-2026-102066juniper networksjunos os+1EPSS score0.27%
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface.CVE-2026-102064juniper networksjunos os+1EPSS score0.37%
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer.CVE-2026-102062juniper networksjunos osEPSS score0.41%
An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server.CVE-2026-101997juniper networksjunos osEPSS score0.39%
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a configured Security Intelligence feed connection.CVE-2026-101996juniper networksjunos os+1EPSS score0.27%
A Reachable Assertion vulnerability in the
l2ald
daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message.CVE-2026-101994juniper networksjunos os+1EPSS score0.28%
An Improper Handling of Length Parameter Inconsistency vulnerability in the
l2ald
daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control or impersonate a configured MC-LAG ICCP peer to disclose process heap memory or cause a denial of service via a malformed ICCP message.