Junos OS: Denial of service in TWAMP client (rmopd)
Summary
A reachable assertion flaw in the TWAMP client of Junos OS allows an unauthenticated remote attacker to disrupt the rmopd service by sending a specific TCP packet. The attack needs no credentials, but only devices with a TWAMP client control connection configured are affected. The CVSS v4.0 score of 9.2 comes from the CNA; NVD has not yet analysed the CVE and lists a CVSS v3.1 score of 7.5. The impact is availability only, with no code execution reported.
Affected
- Junos OS before 23.2R2-S7.7
- Junos OS 23.4 before 23.4R2-S8.13
- Junos OS 24.2 before 24.2R2-S5.5
- Junos OS 24.4 before 24.4R2-S5
- Junos OS 25.2 before 25.2R2-S2
- Junos OS 25.4 before 25.4R1-S3
- Junos OS 26.2 before 26.2R1-S2
- Only if services rpm twamp client control-connection is configured. Default configuration: unaffected.
Fixed in
- Per the CVE record: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
- Releases 23.2, 23.4 and 24.2 have respins; previously published builds were rebuilt.
- Confirm the exact fixed build for this CVE on the vendor advisory JSA112188.
Workaround
- No known workarounds according to the CNA record.
- Restrict which hosts can reach the TWAMP/TCP service on the device until the update is applied.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- Not listed in CISA KEV; CISA SSVC lists exploitation as none and automatable as yes.
- No public proof of concept found.
Our recommendation
- Check whether TWAMP client control connections are configured (show configuration services rpm).
- If they are, upgrade Junos OS to a fixed release from JSA112188, bundled with the October 2026 Junos security updates.
- If patching is not immediately possible, restrict access to the TWAMP/TCP service to trusted hosts.
- Prioritise devices that are internet-facing or peer with untrusted networks.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record CVE-2026-102070 (OpenCVE) app.opencve.io
- Juniper advisory JSA112188 supportportal.juniper.net
- Juniper TWAMP configuration reference www.juniper.net
- CVE list release 2026-10-14 (cvelistV5) github.com
- Juniper vulnerability rollup October 2026 techjacksolutions.com
- Tenable plugin for JSA112188 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:28.
Original description (NVD)
A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.