Key points
- The flaw affects Junos OS versions before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5.
- Junos OS Evolved versions before 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, and 24.4R2-S5-EVO are also affected.
- The National Vulnerability Database rates the issue as critical with a CVSS score of 9.8 for Junos OS and 9.3 for Evolved.
Organizations using Juniper Networks equipment should verify their router firmware versions. A critical vulnerability in the routing protocol daemon allows remote attackers to execute code or crash the system. The flaw exists in specific versions of Junos OS and Junos OS Evolved. If a system runs a version older than the thresholds listed in the NVD record, it is affected.
In plain English
The problem is a stack-based buffer overflow in the rpd process. This means the software can be tricked into accepting too much data. An attacker who is already a configured Border Gateway Protocol peer can send a specific flow-spec update. If the router selects this update for re-advertisement, the rpd process crashes. On standard Junos OS, this crash can lead to remote code execution, giving the attacker control.
The background
The National Vulnerability Database identifies this issue as CVE-2026-101990. It assigns a CVSS score of 9.8, labeling it critical, for standard Junos OS installations. For Junos OS Evolved, the score is 9.3, also critical. The weakness is categorized as CWE-121, a stack-based buffer overflow. The attack requires the peer to be configured and the specific flow-spec update to be selected for re-advertisement.
What changes now
The source material lists specific version thresholds for Junos OS and Junos OS Evolved. Versions before these thresholds are affected by the vulnerability. The NVD record does not state that patches have been released, nor does it confirm the availability of fixes. It only defines the range of affected software versions. Users must compare their current version against these lists to determine exposure.
Who needs to act first
Teams should prioritize updating routers that face external networks or handle traffic from untrusted BGP peers. Before applying any firmware change, create a full configuration backup to allow rollback if issues arise. Test the update in a non-production environment first to ensure stability. If immediate patching is not possible, restrict BGP peering to trusted partners only. Monitor logs for unusual rpd crashes or flow-spec anomalies that might indicate exploitation attempts.
What to do and how to stay safe: Juniper Networks
- Inventory all Juniper routers and record their exact Junos OS or Evolved version numbers.
- Compare current versions against the affected lists to determine if an upgrade is required.
- Schedule maintenance windows to apply the necessary firmware updates to affected devices.
- Verify that BGP peering sessions are established only with trusted and authenticated partners.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Junos OS versions are not affected?
Junos OS 23.2R2-S7.7 and later, 23.4R2-S8.13 and later, 24.2R2-S5.5 and later, and 24.4R2-S5 and later are not affected.
Does this vulnerability affect Junos OS Evolved?
Yes, Junos OS Evolved versions before 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, and 24.4R2-S5-EVO are affected.
What is the main risk of this flaw?
The primary risk is remote code execution on Junos OS or a daemon crash on both Junos OS and Junos OS Evolved.
