Juniper fixes nine critical Junos flaws, several giving root code execution

Juniper fixes nine critical Junos flaws, several giving root code execution

14 October 2026: Juniper Networks has fixed nine critical vulnerabilities in Junos OS and Junos OS Evolved, the operating systems on its routers, switches and firewalls. All nine were published on 14 October under one security bulletin, JSA112187, and Singapore's Cyber Security Agency rated them CVSS 3.1 9.8 in an alert on 19 October that told administrators to patch immediately. Two can be reached by an unauthenticated attacker through the J-Web management interface; most of the rest are in the routing protocol daemon and are reached through BGP.

Not yet independently verified. Juniper's bulletin itself, on its support portal, was not read. The flaw descriptions and fixed releases are taken from Singapore's Cyber Security Agency alert AL-2026-146 and from the NVD records, which name Juniper as the source and date all nine CVEs 14 October 2026. We will update this when it can be confirmed, and remove this note.

The flaws

• CVE-2026-101954: improper authentication in J-Web and its NETCONF session handling lets an unauthenticated network attacker get root-level configuration access and take over the device when web management is enabled.
• CVE-2026-101986: improper authentication in J-Web lets an unauthenticated attacker bypass login and run CGI content with elevated privileges.
• CVE-2026-101983: a stack buffer overflow in the httpd process allows unauthenticated remote code execution and denial of service.
• CVE-2026-102175: a heap overflow in the sdxd service-deployment daemon lets an attacker who can control or intercept the configured SDX/SRC server connection run code as root.
• CVE-2026-102178, CVE-2026-101990: stack overflows triggered by BGP flowspec routes selected for re-advertisement; a configured peer can compromise the routing engine or, on Junos OS, execute code.
• CVE-2026-101982: a stack overflow in rpd triggered by protocol-valid EVPN-VPWS route advertisements from a configured BGP/EVPN peer gives root code execution on Junos OS.
• CVE-2026-33796, CVE-2026-33789: stack overflows in rpd's BGP Monitoring Protocol (BMP) handling; the second can be triggered by an unauthenticated BGP peer when BMP is enabled.

Fixed releases

For Junos OS, the CSA alert lists as affected all versions before 23.2R2-S7.7, 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3 and 26.2 before 26.2R1-S2.

For Junos OS Evolved: all versions before 23.2R2-S7.7-EVO, 23.4 before 23.4R2-S8.11-EVO, 24.2 before 24.2R2-S5.6-EVO, 24.4 before 24.4R2-S5-EVO, 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, 26.2 before 26.2R1-S2-EVO, 25.2X100 before 25.2X100-D35-EVO and 25.4X300 before 25.4X300-D40-EVO. The alert also lists 23.4X100-EVO as affected without a fixed release.

J-Web first, then the BGP peers

The J-Web flaws are the most urgent for any device whose web management is reachable from a network an attacker can use; disabling J-Web or limiting it to a management network removes that exposure until the upgrade is done. The BGP flaws need a configured or adjacent peer, which narrows who can reach them but puts service providers and internet exchange members at the front of the queue, because a compromised or malicious peer is enough. Operators using flowspec, BMP or EVPN-VPWS should check whether those features are enabled, since several flaws depend on them.

The CSA alert does not report exploitation in the wild. Our catalogue lists 6 network security products and 8 network monitoring tools.

Related on TrustList:

• HPE fixes maximum-severity flaws in Aruba AOS-10 and AOS-8 wireless

Sources

• Cyber Security Agency of Singapore: AL-2026-146, Critical Vulnerabilities in Juniper Devices (19 October 2026), 19 October 2026
• Juniper Networks: 2026-10 Security Bulletin, Junos OS and Junos OS Evolved, multiple vulnerabilities resolved (JSA112187), 14 October 2026
• NVD: CVE-2026-101954, 14 October 2026
• NVD: CVE-2026-102175, 14 October 2026