Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-102178: Juniper Junos OS BGP flaw lets attacker take over router
CVE-2026-102178 · published today
Summary
Juniper's Junos OS and Junos OS Evolved have a bug in their BGP routing component that can be triggered by a specially crafted network update. If an attacker can send this malformed update, they could gain control of the router or cause it to stop working. Disable BGP update threading or apply the vendor's security update as soon as possible.
What to do
- Update juniper networks junos os to version 23.2R2-S7.7 or later.
- Update juniper networks junos os evolved to version 23.2R2-S7.7-EVO or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| juniper networks | junos os | < 23.2R2-S7.7 |
| juniper networks | junos os evolved | < 23.2R2-S7.7-EVO |
Original advisory text
Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malformed flowspec NLRI causes routing-engine compromise
A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled.
References
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.3
Critical
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta