What’s Vulnerable › Vulnerabilities
CVE-2026-101959: Junos OS and Junos OS Evolved: A malformed LSP-ping causes an rpd crash
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-14 · updated 2026-10-15
- Weakness: CWE-688
Description
A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping.
Affected products
- Juniper Junos OS: before 23.2R2-S7.7; from 23.4 before 23.4R2-S8.13; from 24.2 before 24.2R2-S5.5; from 24.4 before 24.4R2-S5; from 25.2 before 25.2R2-S2; from 25.4 before 25.4R1-S3 — fixed in 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3
- Juniper Networks Junos OS Evolved: before 23.2R2-S7.7-EVO; from 23.4 before 23.4R2-S8.11-EVO; from 24.2 before 24.2R2-S5.6-EVO; from 24.4 before 24.4R2-S5-EVO; from 25.2 before 25.2R2-S2-EVO; from 25.4 before 25.4R1-S3-EVO — fixed in 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO
How to fix
Upgrade to a fixed version: Juniper Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5; Juniper Networks Junos OS Evolved 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-101959 or the next vulnerability affects your stack