CVE-2026-33780

CVE-2026-33780 concerns a memory leak in Juniper Networks’ l2ald within Junos OS and Junos OS Evolved that is triggered by churn of EVPN-MPLS ESI routes learned from remote multi-homed PE devices. The issue stems from a memory management logic flaw where memory allocated for ESI routes is not rel...

CVE-2023-28978

The CVE-2023-28978 vulnerability affects Juniper Networks Junos OS Evolved and is caused by insecure default initialization of a resource. An unauthenticated, network-based attacker can read confidential information about locally configured administrative users. Affected releases include Junos OS...

CVE-2025-60011

CVE-2025-60011 describes an improper check for unusual or exceptional conditions in Juniper Junos OS and Junos OS Evolved rpd, enabling an unauthenticated, network-based attacker to cause availability impact on downstream devices. When a device receives a specific optional transitive BGP attribut...

CVE-2024-39544

CVE-2024-39544 concerns an issue in Juniper Networks Junos OS Evolved where NETCONF traceoptions files can be read due to incorrect default permissions in the CLI. The vulnerability affects Junos OS Evolved where NETCONF traceoptions are configured, enabling a low-privileged local user to access ...

CVE-2024-47495

CVE-2024-47495 – Junos OS Evolved dual-REs : A local authorization bypass via a user-controlled key can allow a locally authenticated attacker with shell access to take full control on devices running Juniper Networks Junos OS Evolved with dual routing engines. Affected are dual-RE deployments on...

CVE-2025-52988

The CVE-2025-52988 issue is a local OS command injection in the CLI of Juniper Networks Junos OS and Junos OS Evolved. The underlying flaw allows a high-privilege attacker to execute commands as root when crafting arguments to the command 'request system logout', enabling complete device compromi...

CVE-2025-52953

CVE-2025-52953 affects Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated adjacent attacker can send a valid BGP UPDATE, causing a BGP session reset and a sustained DoS. Affected releases include: Junos OS before 21.2R3-S9; 21.4 before 21.4R3-S11; 22.2 before 22.2R3-S7; 22.4 befor...

CVE-2024-21612

CVE-2024-21612 affects Juniper Networks Junos OS Evolved, specifically the Object Flooding Protocol (OFP) service. An improper handling of a syntactically invalid structure allows unauthenticated, network-based attackers to crash OFP by sending specific TCP packets to an open OFP port, causing th...

CVE-2025-59958

This CVE affects Juniper Networks Junos OS Evolved on PTX Series (Packet Forwarding Engine). Affected component: firewall filters (output, on WAN/revenue interfaces). Root cause: improper handling when action is 'reject' causing matching packets to be sent to the Routing Engine, consuming RE reso...

CVE-2026-33793

CVE-2026-33793 describes an Execution with Unnecessary Privileges in the Junos OS/Junos OS Evolved UI. If a device has a configuration that allows unsigned Python op scripts, a non-root user can run malicious op scripts and escalate to root-equivalent privileges, compromising the system. Affected...

CVE-2024-39537

CVE-2024-39537 affects Juniper Networks Junos OS Evolved on the ACX 7000 Series. Root cause: initialization error allows processes that should be internal to be reachable over the network via open ports, enabling an unauthenticated, network-based attacker to cause limited information disclosure a...

CVE-2024-47499

CVE-2024-47499 affects Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated, network-based attacker can trigger a DoS by sending a malformed AS PATH attribute over an established BGP session in BMP rib-in pre-policy monitoring, causing the RPD to crash and restart. The issue affects...

CVE-2026-33803

CVE-2026-33803 (Junos OS Evolved) : A wrong initialization allows a process that should be internal to be reachable over the network via an open port, exposing the device and increasing CPU usage from ingress processing. Affects Junos OS Evolved releases prior to the following: 23.2R2-S7-EVO, 23....

CVE-2025-52964

CVE-2025-52964 is a Reachable Assertion vulnerability in Juniper Networks Junos OS and Junos OS Evolved rpd. An unauthenticated, network-based attacker can trigger a crash by sending a specific BGP UPDATE packet when BGP multipath pause-computation-during-churn is configured, leading to a sustain...

CVE-2025-60003

CVE-2025-60003 affects Juniper Networks Junos OS and Junos OS Evolved. A Buffer Over-read in the routing protocol daemon (rpd) can be triggered by a BGP update containing specific optional transitive attributes when peers are not 4-byte-AS capable, causing the rpd process to crash and the device ...

CVE-2025-52986

Summary: CVE-2025-52986 is a memory leak in Juniper Networks Junos OS and Junos OS Evolved’s routing protocol daemon (rpd) triggered when RIB sharding is enabled and a user runs certain routing-related show commands. The leak can exhaust memory, causing rpd to crash and restart, impacting device ...

CVE-2025-59960

CVE-2025-59960 affects Juniper Networks Junos OS and Junos OS Evolved. The vulnerability arises in the DHCP service (jdhcpd) where the default DHCP relay behavior allows Option 82 information from a client in one subnet to reach the DHCP server unmodified, enabling a DHCP client to exhaust addres...

CVE-2026-21911

CVE-2026-21911 affects Juniper Networks Junos OS Evolved via an Incorrect Calculation in the Layer 2 Control Protocol Daemon (l2cpd). An unauthenticated, network-adjacent attacker can flap the management interface to disrupt MAC learning over label-switched interfaces (LSI). Impact described in t...

CVE-2025-52984

CVE-2025-52984 – Juniper Junos OS / Junos OS Evolved Root cause: a NULL pointer dereference in the routing protocol daemon (rpd) when a static route points to a reject next hop and a gNMI query is processed for that route, causing rpd to crash and restart and thus impacting device availability. A...

CVE-2025-52946

CVE-2025-52946 is a Use After Free in Juniper Junos OS and Junos OS Evolved rpd triggered by a BGP update containing a specifically malformed AS PATH, causing the rpd process to crash and restart and resulting in DoS when traceoptions are enabled. Affected: Junos OS and Junos OS Evolved across mu...

CVE-2025-52949

CVE-2025-52949 describes an Improper Handling of Length Parameter Inconsistency in Juniper’s rpd component of Junos OS and Junos OS Evolved. A logically adjacent BGP peer can send a specifically malformed BGP update in EVPN environments, causing rpd to crash and restart, leading to a Denial of Se...

CVE-2026-21921

Summary (CVE-2026-21921) : A Use After Free in the chassis daemon (chassisd) of Juniper Junos OS and Junos OS Evolved can allow a network-based attacker with low privileges to cause a Denial-of-Service. The issue arises when telemetry collectors repeatedly subscribe/unsubscribe to sensors, causin...

CVE-2026-33776

CVE-2026-33776 affects Juniper Networks Junos OS and Junos OS Evolved. A Missing Authorization flaw in the CLI allows a local, low-privilege user to read sensitive information by executing the command 'show mgd' with specific arguments. Affected Junos OS versions include all before 22.4R3-S8, 23....

CVE-2025-52954

CVE-2025-52954 affects Juniper Networks Junos OS Evolved: a Missing Authorization vulnerability in the internal VRF allows a local, low-privileged user who can send packets over the VRF to gain root privileges and modify configuration, enabling system compromise. Impact is elevation of privileges...

CVE-2025-59962

CVE-2025-59962 affects Juniper Networks Junos OS and Junos OS Evolved with BGP sharding enabled. The issue is an Access of Uninitialized Pointer in the routing protocol daemon (rpd) that can crash and restart rpd when indirect next-hop updates trigger route re-resolution (e.g., an IGP change affe...

CVE-2026-33783

Junos OS Evolved on PTX Series is affected when SRTE policy tunnels are provisioned via PCEP and gRPC is used to monitor traffic; evo-aftmand crashes and requires manual restart, causing persistent DoS. The issue occurs only if the Originator ASN field in PCEP exceeds 65,535 (32-bit ASN). Affecte...

CVE-2025-59961

CVE-2025-59961 describes an Incorrect Permission Assignment vulnerability in Juniper’s DHCP daemon (jdhcpd) used by Junos OS and Junos OS Evolved. A local, low-privilege user can write to the Unix socket that manages jdhcpd, enabling administrative control over the DHCP service. Affected products...

CVE-2026-57028

CVE-2026-57028 affects Juniper Networks Junos OS Evolved. An incorrectly initialized process meant to communicate only internally can be reached over the network via an open port, enabling an unauthenticated, network-based attacker to gain unauthorized access to license management. Affected scope...

CVE-2025-60010

CVE-2025-60010 affects Juniper Junos OS and Junos OS Evolved. A password-aging flaw in the RADIUS client lets an authenticated, network-based attacker log in without enforcing a required password change, using an expired but correct password. Affected versions include: Junos OS pre-22.4R3-S8, 23....

CVE-2026-33788

CVE-2026-33788 affects Juniper Networks Junos OS Evolved on PTX Series (PTX10004/PTX10008/PTX100016 with JNP10K-LC1201/1202). The issue is a Missing Authentication for Critical Function in Flexible PIC Concentrators (FPCs) that allows a local, authenticated, low-privilege user to gain direct acce...

CVE-2025-59959

CVE-2025-59959 describes an Untrusted Pointer Dereference in Juniper Networks Junos OS and Junos OS Evolved routing protocol daemon (rpd). A local, authenticated attacker with low privileges can trigger a crash/restart of rpd by running the command: show route detail when at least one output rou...

CVE-2025-59969

CVE-2025-59969 affects Junos OS Evolved on PTX Series and QFX5000 Series. The vulnerability is a buffer copy without size checking in the advanced forwarding toolkit components evo-aftmand and evo-pfemand, leading to a Denial of Service when an attacker—positioned adjacent—sends crafted multicast...