CVE-2026-101940 in Junos OS
Summary
by MITRE • 10/14/2026
A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The identified security flaw resides within the Route Policy Daemon, commonly referred to as rpd, which serves as the core routing engine for Juniper Networks Junos OS and Junos OS Evolved platforms. This vulnerability manifests specifically when the system is configured with ISO-VPN features alongside egress-protection mechanisms. The root cause of this issue is a NULL pointer dereference error triggered by malformed or specific BGP UPDATE messages received from an unauthenticated but configured Border Gateway Protocol peer. In standard software engineering, a null pointer dereference occurs when a program attempts to access memory through a pointer that has not been initialized or points to no valid object. When the rpd process encounters this condition during the processing of routing updates under the specified configuration conditions, it fails to handle the error gracefully and consequently crashes. This crash results in the termination of the rpd daemon, which is critical for maintaining the router's forwarding plane and control plane integrity.
From an operational perspective, the impact of this vulnerability is severe due to its potential to cause a complete denial of service against the affected network infrastructure. Because the attack vector requires only that the attacker be configured as a BGP peer, it does not necessarily require authentication bypass if the administrative configuration already permits the connection. However, the lack of authentication for the initial session establishment or specific message validation allows an unauthenticated actor to exploit this flaw once connectivity is established. The resulting crash disrupts all routing protocols and potentially affects traffic forwarding depending on how Junos OS handles daemon restarts and state synchronization during such failures. This leads to significant network instability, loss of reachability, and potential service outages for downstream customers or internal services relying on the affected router's routing decisions.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-476, which defines NULL Pointer Dereference as a weakness where an application dereferences a null pointer, resulting in unexpected termination or crash. The exploitation of this flaw is categorized under MITRE ATT&CK technique T1498, specifically Network Denial of Service via resource exhaustion or service disruption through protocol abuse. Attackers can leverage BGP UPDATE messages to trigger the condition without needing prior authentication credentials for the specific malicious payload delivery, provided they are allowed into the BGP session by existing configuration policies. This highlights a critical gap in input validation within the routing daemon's handling of complex VPN and protection configurations.
Mitigation strategies must focus on both immediate operational controls and long-term architectural improvements. The primary recommendation is to apply vendor-provided software patches or updates that address this specific NULL pointer dereference issue as soon as they become available from Juniper Networks support channels. In the interim, network administrators should restrict BGP peering relationships to trusted sources only and implement strict access control lists on border routers to limit which IP addresses can establish BGP sessions with the vulnerable device. Additionally, disabling ISO-VPN or egress-protection features if they are not strictly required for business operations can reduce the attack surface by removing the specific code path that triggers the vulnerability. Continuous monitoring of routing tables and daemon health metrics is also advised to detect any unexpected restarts of the rpd process which may indicate an attempted exploitation.