Juniper Networks Patches Critical Junos OS Vulnerabilities Across Core Platforms

TL;DR

Juniper Networks published its October 2026 security bulletins on October 14, 2026, resolving dozens of critical Junos OS vulnerabilities. Several flaws carry a 9.8 CVSS v3.1 score and allow unauthenticated remote code execution or full device takeover. Consequently, network administrators must deploy the updated software releases immediately to protect their routing and firewall infrastructure.

Notable CVEs

Why It Matters

Junos OS and Junos OS Evolved power core enterprise routers, data center switches, and service provider firewalls worldwide. While exact global deployment counts are not specified in the advisories, thousands of organizations rely on MX, SRX, PTX, EX, and QFX hardware.

These newly disclosed Junos OS vulnerabilities expose core network devices to complete compromise and severe service outages. In each advisory, the vendor notes that “These issues were found during extensive internal product security testing.” Furthermore, the company confirms that “Juniper SIRT is not aware of any malicious exploitation of these vulnerabilities.” Currently, no public proof-of-concept exists, and no active exploitation in the wild has been confirmed.

How the Attack Works

The October 2026 update bundle spans multiple advisories targeting specific hardware series and general operating system branches. Attackers can exploit these flaws via network protocols, management interfaces, and local services.

Core Operating System and J-Web Flaws

First, the combined Junos OS and Junos OS Evolved bulletin (JSA112187) addresses over 60 routing and management bugs. Notably, CVE-2026-101954 (CVSS 9.8) allows unauthenticated network access to trigger a full device takeover when J-Web is enabled. Similarly, CVE-2026-101986 (CVSS 9.8) permits pre-authentication CGI execution in J-Web, while CVE-2026-101983 (CVSS 9.8) enables remote code execution when a J-Web virtual-domain is configured.

In addition, BGP and routing protocol daemon (rpd) flaws dominate the bulletin. For instance, CVE-2026-33796 (CVSS 9.8) allows remote root command execution when BMP route monitoring is enabled. Meanwhile, CVE-2026-102175 (CVSS 9.8) triggers remote code execution during service-deployment processing. Several other critical bugs, including CVE-2026-101990, CVE-2026-101982, CVE-2026-102178, and CVE-2026-33789, allow malformed BGP or EVPN traffic to crash the routing daemon or compromise the Routing Engine.

Separately, the standalone Junos OS security bulletin (JSA112188) resolves 11 distinct flaws. Here, CVE-2026-101956 (CVSS 9.8) permits unauthorized root command execution via J-Web. Additionally, CVE-2026-101980 (CVSS 9.8) lets malformed Extended Echo requests reboot the Routing Engine. Furthermore, CVE-2026-103994 (CVSS 8.8) uses a crafted OVSDB message to crash the vgd process and execute remote code.

MX Series and SRX Series Platform Bugs

Hardware-specific Junos OS vulnerabilities also pose severe risks to perimeter and edge equipment. According to the MX Series security advisory (JSA112196), three distinct flaws impact MX routers. Most critically, CVE-2026-102182 (CVSS 9.8) allows certificate-based IKE packets to cause root-level code execution. The remaining two bugs, CVE-2026-102046 and CVE-2026-102063, trigger denial-of-service conditions via SCTP services and HFRR link protection.

Meanwhile, the SRX Series security advisory (JSA112186) patches 11 firewall vulnerabilities. Specifically, CVE-2026-33792 (CVSS 9.8) enables remote code execution and denial of service when a GRE tunnel is configured. Another critical flaw, CVE-2026-101950 (CVSS 9.8), uses malformed IPv4 packets to crash the packet-forwarding process when Secure Vector Routing is enabled. Moreover, CVE-2026-33798 (CVSS 8.8) and CVE-2026-102174 (CVSS 8.8) permit code execution via SRX chassis-cluster setups and JIMS identity publishing.

Junos OS Evolved Specific Issues

Finally, Juniper addressed 11 platform-specific bugs in its Junos OS Evolved bulletin (JSA112250). The highest-rated flaw, CVE-2026-102031 (CVSS 9.8), allows a low-privileged TACACS+ user to execute root commands when authorization refresh is active. As detailed in the JSA112250 documentation, PTX Series routers also face root-level compromise via attacker-controlled DHCP responses (CVE-2026-101967) or gRPC responses (CVE-2026-101978) during zero-touch provisioning.

Affected Versions

These Junos OS vulnerabilities affect a wide range of software branches prior to the latest maintenance releases. For standard Junos OS, affected versions include all releases before 23.2R2-S7.7, 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3, and 26.2 before 26.2R1-S2.

For Junos OS Evolved, vulnerable versions include all releases before 23.2R2-S7.7-EVO, 23.4 before 23.4R2-S8.11-EVO, 24.2 before 24.2R2-S5.6-EVO, 24.4 before 24.4R2-S5-EVO, 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, and 26.2 before 26.2R1-S2-EVO. In addition, special Evolved branches 23.4X100-EVO, 25.2X100 before 25.2X100-D35-EVO, and 25.4X300 before 25.4X300-D40-EVO are impacted.

Patch and Mitigation Steps

Regarding mitigations, Juniper states that “There are no known workarounds for all of these issues.” However, the vendor adds, “Refer to the specific CVE records for additional details on potential individual workarounds.”

To remediate the flaws, administrators must upgrade Junos OS devices to versions 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, or subsequent releases. Similarly, Junos OS Evolved operators should update to 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, or 26.4R1-EVO. For versions 23.2, 23.4, and 24.2, operators should install the newly rebuilt software respins.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.