Juniper Junos OS Buffer Overflow Risks Root Code Execution for MSPs
A critical stack-based buffer overflow in Juniper routing daemons allows configured peers to execute root code or crash services, requiring immediate version checks.
Key points
- CVE-2026-101982 carries a CVSS score of 9.8 or 9.3, rated critical.
- The flaw affects Junos OS and Junos OS Evolved versions prior to specific service releases.
- Attackers can trigger root code execution on Junos OS or daemon crashes on Evolved.
Juniper Networks Junos OS and Junos OS Evolved contain a critical stack-based buffer overflow in the routing protocol daemon. According to the National Vulnerability Database, this flaw, tracked as CVE-2026-101982, allows a configured BGP or EVPN peer to cause root code execution on Junos OS. On Junos OS Evolved, the same input can crash the routing protocol daemon. The vulnerability is rated critical with a CVSS score of 9.8 for Junos OS and 9.3 for Junos OS Evolved.
How it unfolded
- The National Vulnerability Database published records for CVE-2026-101982, detailing the stack-based buffer overflow weakness.
- The entry identifies CWE-121 as the underlying weakness type for the vulnerability in the routing protocol daemon.
- The records specify that the flaw is exploitable via protocol-valid route advertisements for an EVPN-VPWS service.
Who is affected
The vulnerability impacts specific versions of Juniper Networks operating systems. According to the NVD, Junos OS versions before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5 are affected. Junos OS Evolved versions before 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, and 24.4R2-S5-EVO are also vulnerable. The flaw resides in the routing protocol daemon, which handles critical network traffic.
Our take on the response
The distinction in impact between the two operating systems is notable for patch prioritization. Junos OS faces the risk of root code execution, which implies full system compromise. Junos OS Evolved faces a denial of service through daemon crashes. That suggests managed service providers should prioritize Junos OS devices in their remediation efforts, as the potential for lateral movement is higher. The severity rating remains critical in both cases, but the operational consequence differs significantly.
Who needs to act first
Teams usually begin by identifying all devices running vulnerable versions of Junos OS or Junos OS Evolved. Prioritize systems that accept BGP or EVPN traffic from external peers, as these are directly exposed to the attack vector. Before applying any updates, create comprehensive configuration backups to ensure rapid recovery if issues arise. Test the patch in a staging environment that mirrors production traffic patterns to verify stability. If a fix is not immediately available, review access controls to limit which peers can send route advertisements.
Background: Attack vectors
Attack vectors are the paths adversaries use to reach your data. They range from simple phishing emails to complex supply chain compromises. Defending against them requires mapping every entry point, validating inputs, and limiting what each component can do. You cannot stop all attacks, but you can make them costly and slow.
Read the full guide: Attack Vectors Explained: Mechanisms, Limits, and Defense Strategies
What to do and how to stay safe: Juniper Networks
- Audit your network inventory to identify any devices running Junos OS or Junos OS Evolved versions below the specified safe release numbers.
- Verify whether your devices are configured with BGP or EVPN peers, as the vulnerability requires a configured peer to exploit the flaw.
- Monitor routing protocol daemon logs for unexpected crashes or anomalous behavior that could indicate exploitation attempts.
- Once the vendor provides an update, schedule maintenance windows to apply the patch, starting with the most exposed edge devices.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-101982?
The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.8 for Junos OS and 9.3 for Junos OS Evolved.
Which specific Junos OS versions are affected?
Junos OS versions before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5 are affected by this stack-based buffer overflow.
What is the impact on Junos OS Evolved?
On Junos OS Evolved, a configured peer can cause the routing protocol daemon to crash via protocol-valid route advertisements for an EVPN-VPWS service.
