Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-102070: Junos OS TWAMP client can be stopped by crafted packet
CVE-2026-102070 · published today
Summary
The TWAMP client built into Junos OS can be triggered by a specially formed network packet to shut down the rmopd service, which handles measurement traffic. An attacker on the same network does not need credentials to cause this disruption, potentially affecting monitoring and performance data. Apply the latest Juniper Junos OS update that corrects the issue.
What to do
- Update juniper networks junos os to version 23.2R2-S7.7 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| juniper networks | junos os | < 23.2R2-S7.7 |
Original advisory text
Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is used
A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet.
References
- https://supportportal.juniper.net/JSA112188 vendor-advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
9.2
Critical
Type
CWE-617Reachable Assertion
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta