CVE-2026-101982 in Junos OS
Summary
by MITRE • 10/14/2026
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified involves a critical stack-based buffer overflow within the routing protocol daemon, known as rpd, in both Juniper Networks Junos Operating System and Junos OS Evolved platforms. This flaw specifically impacts the handling of Border Gateway Protocol (BGP) Extended Community for Ethernet Virtual Private Wire Service (EVPN-VPWS). The root cause lies in insufficient boundary checking when processing route advertisements from a configured BGP peer that is established as an EVPN-VPWS endpoint. An attacker who has already gained access to the network and can establish a valid BGP session with the affected device may exploit this memory corruption issue by sending specially crafted protocol-valid route advertisements. These maliciously constructed packets contain data structures that exceed the allocated buffer space on the stack, leading to overwriting of adjacent memory locations including return addresses or function pointers.
In environments running traditional Junos OS, successful exploitation of this vulnerability allows for arbitrary code execution with root privileges. This is due to the fact that the rpd process typically runs with elevated permissions necessary to manage routing tables and interface configurations. Consequently, an attacker can gain full control over the underlying operating system, install backdoors, exfiltrate sensitive data, or pivot further into the internal network infrastructure. For deployments utilizing Junos OS Evolved, which is built on a Linux kernel architecture, the impact manifests as a denial of service condition resulting in the crash of the rpd process. While this does not immediately grant code execution privileges to an unauthenticated attacker, it disrupts critical routing functions and can lead to significant network instability or outages depending on the redundancy mechanisms in place.
From a technical classification perspective, this vulnerability aligns with CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow). The attack vector is classified under ATT&CK technique T1190: Exploit Public-Facing Application, as it leverages vulnerabilities in network services that are often exposed to external peers. Furthermore, the requirement for a configured BGP peer indicates that this is not an unauthenticated remote exploit but rather requires initial access or insider threat capabilities, placing it within the context of lateral movement and privilege escalation once inside the perimeter. The specific targeting of EVPN-VPWS route advertisements highlights how complex overlay network protocols can introduce subtle memory management errors if input validation is not rigorously enforced during parsing routines.
Mitigation strategies must prioritize immediate patching to the latest stable release of Junos OS or Junos OS Evolved that includes fixes for this specific rpd flaw. Network administrators should verify their version numbers against vendor advisories and apply updates during scheduled maintenance windows. In addition to software remediation, network segmentation policies should be reviewed to ensure that BGP peering sessions are restricted only to trusted peers using strict access control lists or firewall rules. Implementing route filtering on border routers can also help mitigate the risk by dropping malformed or unexpected route advertisements before they reach the rpd process. Monitoring for unusual routing table changes or sudden crashes in the rpd service should be integrated into existing security information and event management systems to detect potential exploitation attempts early.