CVE-2026-101990 is a critical stack-based buffer overflow in the Juniper Networks Junos OS and Junos OS Evolved routing protocol daemon (rpd). A configured BGP peer can trigger it with a crafted flow-spec update.
What Is It
The vulnerability sits in rpd, the routing protocol daemon in Junos OS and Junos OS Evolved. It is classified as CWE-121 (stack-based buffer overflow). A remote, configured BGP peer can exploit it by sending a flow-spec update that is selected for re-advertisement. On both platforms this can crash rpd. On Junos OS it can also lead to remote code execution.
Why It Matters
Juniper's CVSS v3.1 base score is 9.8 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS v4.0 score is 9.3 (Critical). Both vectors describe a network attack with low complexity, no privileges and no user interaction, and high impact to confidentiality, integrity and availability.
The attacker has to be a configured BGP peer. Even so, an rpd crash disrupts routing on the affected device, and on Junos OS the flaw can lead to code execution. The CISA KEV catalog has no entry for this CVE, so the supplied data does not confirm active exploitation. NVD lists the record as "Received" (published 2026-10-14).
What's Vulnerable
Junos OS, affected versions: - All versions before 23.2R2-S7.7 - 23.4 before 23.4R2-S8.13 - 24.2 before 24.2R2-S5.5 - 24.4 before 24.4R2-S5 - 25.2 before 25.2R2-S2 - 25.4 before 25.4R1-S3 - 26.2 before 26.2R1-S2
Junos OS Evolved, affected versions: - All versions before 23.2R2-S7.7-EVO - 23.4 before 23.4R2-S8.11-EVO - 24.2 before 24.2R2-S5.6-EVO - 24.4 before 24.4R2-S5-EVO - 25.2 before 25.2R2-S2-EVO - 25.4 before 25.4R1-S3-EVO - 26.2 before 26.2R1-S2-EVO - 23.4X100 (affected; the record lists no fixed version) - 25.2X100 before 25.2X100-D35-EVO - 25.4X300 before 25.4X300-D40-EVO
Patch Status
Based on the version boundaries above, fixed releases include 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2 for Junos OS. Junos OS Evolved has matching -EVO releases, plus 25.2X100-D35-EVO and 25.4X300-D40-EVO. The record gives no fixed release for the 23.4X100 train.
There is no CISA KEV entry, so no federal required action or due date has been issued. Administrators should read Juniper advisory JSA112187 and upgrade to a fixed release for their train.
Sources
- NVD, CVE-2026-101990
- Juniper Security Advisory JSA112187
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)