IT SBIT Services
Schneeberger
DEEN
CVE tracker

Juniper Junos OS: Denial of service in rpd via crafted BGP ISO-VPN update

CVE-2026-101952High 8.7

← All vulnerabilities

Summary

Junos OS and Junos OS Evolved are affected. A configured BGP peer that exchanges ISO-VPN routes can send a specific ISO-VPN update that crashes the routing protocol daemon (rpd). The crash only occurs when BMP route monitoring or NSR (nonstop routing) is enabled, and the impact is a denial of service that disrupts routing. Juniper's SIRT is not aware of any malicious exploitation.

Affected

  • Junos OS: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2
  • Junos OS Evolved: before 23.2R2-S7.7-EVO; 23.4 before 23.4R2-S8.11-EVO; 24.2 before 24.2R2-S5.6-EVO; 24.4 before 24.4R2-S5-EVO; 25.2 before 25.2R2-S2-EVO; 25.4 before 25.4R1-S3-EVO; 26.2 before 26.2R1-S2-EVO; 23.4X100; 25.2X100 before 25.2X100-D35-EVO; 25.4X300 before 25.4X300-D40-EVO
  • Vulnerable configuration: protocols bgp family iso-vpn unicast, plus routing-options bmp station or routing-options nonstop-routing
  • Note: the X100 and X300 entries are unclear and must be confirmed in the Juniper advisory

Fixed in

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2 and all later releases (the advisory also lists 21.2R3-S11, 21.4R3-S12, 22.2R3-S8, 22.3R3-S5, 22.4R3-S9)
  • Junos OS Evolved: 23.2R2-S7-EVO, 23.4R2-S8-EVO, 24.2R2-S5-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 26.2R1-S2-EVO and all later releases
  • Note: the affected and fixed Evolved version strings differ slightly in the advisory, so check the table in JSA112187

Workaround

  • No known workarounds according to Juniper.
  • Inferred, not confirmed by the vendor: disabling BMP and NSR where they are not needed, and restricting BGP ISO-VPN peers, should reduce exposure.

Exploitation

  • Juniper SIRT is not aware of any malicious exploitation.
  • CISA SSVC: exploitation none, automatable yes, technical impact partial.
  • EPSS 0.00373 (per the EUVD record).

Our recommendation

  • Check whether any device runs BGP with the iso-vpn family together with BMP or NSR. If none does, the risk is low.
  • Patch affected devices to a fixed release from the Juniper advisory for your platform and train.
  • Until patching, disable BMP and NSR where they are not required and restrict BGP peering to trusted neighbours.
  • Verify the final version data and the NVD record before closing this item, because the sources differ on some version strings.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:54.

Original description (NVD)

An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed