Description
A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled.
Published: 2026-10-14
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service via routing‑daemon crash caused by a NULL Pointer Dereference in Juniper’s BGP routing daemon when ISO‑VPN egress protection is enabled
Action: Immediate Patch
AI Analysis

Impact

A NULL Pointer Dereference in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to trigger a crash when it sends a BGP UPDATE message while ISO‑VPN and egress‑protection are enabled. The crash causes a denial of service, rendering the router unavailable until a reboot or watchdog restoration. The impact is full outage of routing services for the affected device.

Affected Systems

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved. All releases listed as affected are – Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and every subsequent release; and the analogous Junos OS Evolved releases 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all later releases.

Risk and Exploitability

The CVSS score of 8.7 indicates a high‑severit y denial‑of‑service flaw. The EPSS score is not available, but the vulnerability can be invoked by simply sending a crafted BGP UPDATE from an unauthenticated peer, making exploitation likely in networks that employ ISO‑VPN egress protection. The flaw is not listed in CISA’s KEV catalog, yet its impact and the ease of triggering it over the network raise the overall risk for affected routers.

Generated by OpenCVE AI on October 14, 2026 at 21:29 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Upgrade Juniper’s Junos OS or Junos OS Evolved to any of the patched releases listed by Juniper – any release equal to or newer than those in the advisory – or to a subsequent release that incorporates the fix
  • Reconfigure BGP peers to enforce authentication (e.g., MD5 or stronger) and review the necessity of ISO‑VPN egress protection; disable it if not required or ensure it is correctly implemented to prevent inadvertent crashes
  • Enable a system watchdog or high‑availability mechanism to automatically recover the routing daemon if it crashes, and monitor daemon logs to detect repeated crashes for proactive response

Generated by OpenCVE AI on October 14, 2026 at 21:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled.
Title Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP ISO-VPN egress protection is enabled
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-14T16:41:35.328Z

Reserved: 2026-09-28T16:22:33.604Z

Link: CVE-2026-101940

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T17:17:46.543

Modified: 2026-10-14T17:17:46.543

Link: CVE-2026-101940

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-14T21:30:08Z

Weaknesses