Key points
- The vulnerability, CVE-2026-101990, is rated critical with a CVSS score of up to 9.8.
- Attackers can trigger remote code execution on Junos OS or crash the routing daemon.
- Exploitation requires a remote configured BGP peer sending specific flow-spec updates.
A critical security flaw in Juniper Networks Junos OS and Junos OS Evolved exposes networks to remote code execution and service disruption. The vulnerability, identified as CVE-2026-101990, resides in the routing protocol daemon and allows attackers to compromise infrastructure through standard Border Gateway Protocol interactions.
By the numbers
- CVSS 9.8: The maximum severity rating assigned to the vulnerability in Junos OS.
- CVSS 9.3: The severity rating assigned to the vulnerability in Junos OS Evolved.
- CWE-121: The Common Weakness Enumeration identifier for the stack-based buffer overflow.
What the figures mean
The severity scores indicate the high impact of the flaw. According to the National Vulnerability Database, the issue is a stack-based buffer overflow in the rpd process. This means that when the daemon processes certain data, it writes beyond the allocated memory space, allowing an attacker to overwrite execution pointers or crash the service.
This vulnerability affects multiple versions of Juniper’s operating systems. Affected releases include Junos OS versions before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5. Similarly, Junos OS Evolved versions before 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, and 24.4R2-S5-EVO are vulnerable. Organizations running these older builds are at risk.
What should you do?
Managed service providers must prioritize inventorying all customer-facing routers running Junos software. Immediate assessment of BGP peer configurations is essential, as the exploit relies on traffic from configured peers. Teams should verify if flow-spec updates are being accepted from untrusted sources.
Operational impact
Organizations should immediately notify security operations centers and network engineering teams about this exposure. Internal communication must clarify which customer segments rely on affected Juniper hardware. Service delivery managers need to assess potential downtime risks for clients using vulnerable versions. Procurement teams should review vendor support contracts to ensure timely access to patches. Leadership must prepare for potential service interruptions during remediation efforts.
What to do and how to stay safe: Juniper Networks
- Audit all Juniper devices to identify those running versions prior to the fixed releases listed in the advisory.
- Restrict BGP flow-spec update acceptance to trusted peers only, if your network policy allows such segmentation.
- Monitor system logs for unexpected rpd crashes or restarts that may indicate exploitation attempts.
- Prepare an incident response plan that includes isolating affected routers until a vendor update is available.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific Juniper products are affected by CVE-2026-101990?
Juniper Networks Junos OS and Junos OS Evolved versions prior to the specific service releases listed in the NVD record are affected.
How is this vulnerability exploited?
A remote configured BGP peer can send a flow-spec update that is selected for re-advertisement, triggering the buffer overflow.
What are the potential consequences of this flaw?
Attackers can cause the routing protocol daemon to crash or execute remote code on Junos OS systems.
