CVE-2026-101982 is a critical stack-based buffer overflow in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. According to the NVD record, a configured BGP/EVPN peer can trigger it with route advertisements for an EVPN-VPWS service.
What Is It
The flaw is a stack-based buffer overflow (CWE-121) in rpd, the routing protocol daemon in Junos OS and Junos OS Evolved. According to the NVD record, a configured BGP/EVPN peer can trigger it by sending protocol-valid route advertisements for an EVPN-VPWS service. The record says the result depends on the platform:
- Junos OS: code execution as root
- Junos OS Evolved: rpd crash
The record was published on 2026-10-14. Its NVD status is "Received," so NVD has not finished analyzing it yet.
Why It Matters
Juniper scores the flaw 9.8 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 CRITICAL under CVSS 4.0. According to the advisory, successful exploitation on Junos OS can let an attacker execute code as root on the device. On Junos OS Evolved, the advisory describes the impact as a crash of rpd, the daemon that handles routing.
The CISA KEV entry supplied for this CVE is empty. KEV does not confirm active exploitation, and the supplied data includes no CISA-mandated required action or due date.
What's Vulnerable
According to the vendor, the issue affects deployments that use EVPN-VPWS with a configured BGP/EVPN peer. Operators should check the advisory to confirm whether their configuration is in scope. Affected versions per the vendor:
Junos OS - All versions before 23.2R2-S7.7 - 23.4 before 23.4R2-S8.13 - 24.2 before 24.2R2-S5.5 - 24.4 before 24.4R2-S5 - 25.2 before 25.2R2-S2 - 25.4 before 25.4R1-S3 - 26.2 before 26.2R1-S2
Junos OS Evolved - All versions before 23.2R2-S7.7-EVO - 23.4 before 23.4R2-S8.11-EVO - 24.2 before 24.2R2-S5.6-EVO - 24.4 before 24.4R2-S5-EVO - 25.2 before 25.2R2-S2-EVO - 25.4 before 25.4R1-S3-EVO - 26.2 before 26.2R1-S2-EVO - 23.4X100 (affected; the record lists no fixed version) - 25.2X100 before 25.2X100-D35-EVO - 25.4X300 before 25.4X300-D40-EVO
Patch Status
Based on the affected-version ranges in the record, these appear to be the fixed releases:
- Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2
- Junos OS Evolved: the matching -EVO releases, plus 25.2X100-D35-EVO and 25.4X300-D40-EVO
The supplied data names no fixed release for the 23.4X100 train. Operators should upgrade to a fixed release for their train. For full remediation details, including any workarounds, check Juniper advisory JSA112187.
Sources
- Juniper Networks Security Advisory JSA112187
- NVD – CVE-2026-101982
- CISA Known Exploited Vulnerabilities Catalog (no entry provided for this CVE)