Key points
- Juniper Networks assigns a CVSS score of 9.8 to this critical vulnerability.
- The flaw affects Junos OS and Junos OS Evolved versions prior to specific maintenance releases.
- No patch has been confirmed as available for the affected versions in the source material.
Juniper Networks Junos OS and Junos OS Evolved contain a critical security flaw. The vulnerability is a stack-based buffer overflow within the Border Gateway Protocol routing daemon. A configured BGP flowspec peer can exploit this issue. This allows for routing-engine compromise or a denial of service against the routing daemon. The attack vector involves flowspec route re-advertisement. This occurs specifically when BGP update-threading is enabled on the device.
In plain English
The problem lies in how the system handles certain routing updates. When BGP update-threading is turned on, the software does not properly check the size of incoming data. An attacker who is already a configured peer can send malicious flowspec routes. This causes the memory buffer to overflow. The result is either a crash of the routing service or full control of the routing engine. This is a severe risk for network stability and security.
The background
The vulnerability is tracked as CVE-2026-102178. The National Vulnerability Database lists two CVSS scores for this entry. One score is 9.8, rated Critical. The other score is 9.3, also rated Critical. The weakness is classified as CWE-121, a stack-based buffer overflow. This means the software writes more data to a memory block than it can hold. This allows an attacker to overwrite adjacent memory and execute arbitrary code.
What changes now
Organizations using Juniper equipment must check their current software versions. The flaw affects Junos OS versions before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5. It also affects Junos OS Evolved versions before 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, and 24.4R2-S5-EVO. Users running these older builds are vulnerable. They should verify if a fix has been released by the vendor.
Who needs to act first
Teams should prioritize devices that face external networks or untrusted peers. Systems with BGP update-threading enabled are the most exposed. Check which devices run the affected Junos versions listed above. If a fix is available, test it in a lab first. Back up configurations before applying any changes. If no fix exists, restrict BGP flowspec peers to trusted sources only. Monitor logs for unusual routing behavior or daemon crashes.
What to do and how to stay safe: Juniper Networks
- Verify the exact Junos OS version on all routers and switches.
- Check if BGP update-threading is enabled on your devices.
- Restrict BGP flowspec peers to only trusted and necessary partners.
- Monitor system logs for signs of routing daemon instability or crashes.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-102178?
The National Vulnerability Database lists scores of 9.8 and 9.3, both rated Critical.
Which Juniper products are affected by this vulnerability?
Juniper Networks Junos OS and Junos OS Evolved versions prior to specific maintenance releases are affected.
How can an attacker exploit this flaw?
A configured BGP flowspec peer can cause compromise or denial of service via flowspec route re-advertisement.
