Description
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.
Published: 2026-10-14
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service with potential root command execution
Action: Immediate Patch
AI Analysis

Impact

A stack-based buffer overflow in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to send a specially crafted BGP route update when the BGP Monitoring Protocol (BMP) is enabled, causing the daemon to crash and potentially enabling root-level command execution.

Affected Systems

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved. Affected releases include Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases, as well as Junos OS Evolved 23.2R2-S7.7‑EVO, 23.4R2-S8.11‑EVO, 24.2R2-S5.6‑EVO, 24.4R2-S5‑EVO, 25.2R2-S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1-S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1-S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.2, indicating a high severity. EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated BGP peer that can send crafted updates when BMP is enabled; exploitation requires network connectivity to a vulnerable router and BMP enabled on the device.

Generated by OpenCVE AI on October 15, 2026 at 15:08 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

* Disable BMP, or * Avoid configuring 'family inet flow'

OpenCVE Recommended Actions

  • Apply the Juniper patch or upgrade to a release that includes Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 or any later release, or the corresponding Junos OS Evolved releases
  • Disable BMP on the affected devices to prevent the trigger of the buffer overflow
  • Avoid configuring "family inet flow" on the device, as it may expose the vulnerability path

Generated by OpenCVE AI on October 15, 2026 at 15:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved
Vendors & Products Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved

Wed, 14 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.
Title Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in denial of service
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M'}

Subscriptions

Juniper Networks Junos Os Junos Os Evolved
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-15T03:57:07.361Z

Reserved: 2026-03-23T19:46:13.672Z

Link: CVE-2026-33789

cve-icon Vulnrichment

Updated: 2026-10-14T19:04:17.571Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:18:27.763

Modified: 2026-10-15T16:24:19.073

Link: CVE-2026-33789

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T22:30:12Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow