CVE-2026-101982: Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used

Published Oct 14, 2026

Updated

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.

Affected Software

2 affected components

Juniper Networks Junos OS

Juniper Networks Junos OS Evolved

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 23.2R2-S7.7-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 23.4R2-S8.11-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.2R2-S5.6-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.4R2-S5-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.2R2-S2-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.2X100-D35-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4R1-S3-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4R2-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4X300-D40-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.2R1-S2-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.2R2-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.4R1-EVO
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 23.2R2-S7.7
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 23.4R2-S8.13
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 24.2R2-S5.5
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 24.4R2-S5
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 25.2R2-S2
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 25.4R1-S3
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 25.4R2
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 26.2R1-S2
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 26.2R2
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 26.4R1

Event History

Oct 14, 2026

CVE Published

via MITRE·05:17 PM

Data Sourced

via MITRE·05:17 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to exploitation?

Exposure requires an EVPN-VPWS service and a configured BGP/EVPN peer. The vulnerable component is the routing protocol daemon (rpd) in Junos OS and Junos OS Evolved.

What access does an attacker need?

An attacker must be a configured BGP/EVPN peer capable of sending protocol-valid EVPN route advertisements for the EVPN-VPWS service. No separate local privileges or user interaction are indicated.

What is the impact on each affected platform?

On Junos OS, a malicious configured peer can achieve code execution as root. On Junos OS Evolved, the described impact is an rpd crash.