Juniper Junos OS Evolved 25.4 PTX Series Unauthenticated Remote Code Execution

Juniper Junos OS Evolved on PTX Series versions before 25.4R1-S1-EVO and 25.4R2-EVO contain an unauthenticated remote code execution vulnerability. The supplied proof of concept creates and executes a command through the affected configuration API. https://packetstorm.news/download/237898...

Demon Routing Protocol Daemon RCE

The vulnerability of the Demon Routing Protocol Daemon RPD in Juniper Networks’ Junos OS and Junos OS Evolved operating systems is related to incorrect initialization of resources. Exploiting this vulnerability allows a malicious actor to cause service failure by repeatedly announcing an outdated...

CVE-2026-101983

A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured...

CVE-2026-101975

A Reachable Assertion vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured...

CVE-2026-101981

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message...

CVE-2026-101959

A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping...

CVE-2026-101954 Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled

An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web...

CVE-2026-101954 Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled

An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web...

CVE-2026-101954

Juniper Networks Junos OS and Junos OS Evolved are affected by an Improper Authentication vulnerability (CWE-287) in the J-Web management interface and its NETCONF session handling . An unauthenticated network attacker can exploit a reachable J-Web HTTP or HTTPS service to obtain root-level devic...

CVE-2026-101952 Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabled

An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or...

CVE-2026-101952 Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabled

An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or...

CVE-2026-101952

A vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to trigger an rpd crash . This occurs when the peer sends a specific ISO-VPN update that is subsequently processed by BMP route monitoring or NSR . No inform...

CVE-2026-101949 Junos OS and Junos OS Evolved: In a scenario with VPN-flowspec and BMP monitoring a specific BGP update causes an rpd crash

A NULL Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is...

CVE-2026-101949

A NULL Pointer Dereference vulnerability exists in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved . An unauthenticated remote BGP neighbor can trigger a denial of service (DoS) by sending a specific BGP update. This occurs specifically when VPN-flowspec is act...

CVE-2026-101949 Junos OS and Junos OS Evolved: In a scenario with VPN-flowspec and BMP monitoring a specific BGP update causes an rpd crash

A NULL Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is...

CVE-2026-101964 Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP message

A Reachable Assertion vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session...

CVE-2026-101964

A Reachable Assertion vulnerability exists in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved . An adjacent attacker can cause an rpd crash by sending a crafted LDP packet over an established LDP session. No specific exploit details or remediation instructions ...

CVE-2026-101963 Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used

An Incorrect Calculation vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured...

CVE-2026-101963

Juniper Networks Junos OS and Junos OS Evolved are affected by an Incorrect Calculation vulnerability in the routing protocol daemon (rpd) . A remote BGP EVPN neighbor can trigger an rpd crash specifically when SRv6 EVPN multihoming is configured. This vulnerability results in a high impact on sy...

CVE-2026-101963 Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used

An Incorrect Calculation vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured...