IT SBIT Services
Schneeberger
DEEN
CVE tracker

Juniper Junos OS: Denial of service in routing daemon via BGP MVPN update

CVE-2026-102030High 8.7

← All vulnerabilities

Summary

Junos OS and Junos OS Evolved are affected when the routing daemon (rpd) processes a BGP MVPN update and the device uses an inter-region segmented VRF with 'protocols mvpn inter-region-template'. A configured MVPN neighbour can send such an update and cause a denial of service, leading to a routing outage. The vulnerability affects confidentiality and integrity only as far as the vector shows no impact there, and an attacker needs no privileges, but must be a configured MVPN neighbour. The CVSS v4.0 base score in the record is 8.7 (HIGH).

Affected

  • Junos OS: releases before 23.2R2-S7.7; 23.4 to before 23.4R2-S8.13; 24.2 to before 24.2R2-S5.5; 24.4 to before 24.4R2-S5; 25.2 to before 25.2R2-S2; 25.4 to before 25.4R1-S3; 26.2 to before 26.2R1-S2 (default: unaffected)
  • Junos OS Evolved: releases before 23.2R2-S7.7-EVO; 23.4 to before 23.4R2-S8.11-EVO; 24.2 to before 24.2R2-S5.6-EVO; 24.4 to before 24.4R2-S5-EVO; 25.2 to before 25.2R2-S2-EVO; 25.4 to before 25.4R1-S3-EVO; 26.2 to before 26.2R1-S2-EVO; 23.4X100; 25.2X100 to before 25.2X100-D35-EVO; 25.4X300 to before 25.4X300-D40-EVO (default: unaffected)
  • Required configuration: protocols mvpn inter-region-template

Fixed in

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
  • Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
  • Some releases of 23.2, 23.4 and 24.2 (and their Evolved equivalents) were rebuilt as respins; check the advisory for the referenced respins

Workaround

Unknown. Juniper's record lists no known workarounds for this issue.

Exploitation

  • Juniper SIRT is not aware of any malicious exploitation.
  • CISA SSVC: exploitation none, automatable yes, technical impact partial.
  • No public proof of concept was found in the research sources.

Our recommendation

  • Check whether any Junos OS or Junos OS Evolved device runs MVPN with protocols mvpn inter-region-template, especially at ISP or MPLS provider edges.
  • Patch affected devices to the fixed releases in Juniper advisory JSA112187.
  • Until patched, review which BGP neighbours can establish sessions and who can configure MVPN neighbours (general hardening, not confirmed by Juniper).
  • Monitor rpd for crashes or restarts and watch for routing outages.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:20.

Original description (NVD)

An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an inter‑region segmented VRF with 'protocols mvpn inter-region-template' is configured.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed