DEV Community

SorrelThorncroft
SorrelThorncroft

Posted on

CVE-2026-101982 and CVE-2026-101990: Two Route-Advertisement Bugs That End in Root on Junos

#cybersecurity #infosec #networking #security

CVE-2026-101982 and CVE-2026-101990: Two Route-Advertisement Bugs That End in Root on Junos

Most of the October 2026 Junos advisories need a reachable management interface. These two do not. CVE-2026-101982 and CVE-2026-101990 live in the routing protocol daemon, and they are triggered by route advertisements rather than by HTTP requests, which means the attacker's entry point is a BGP session rather than a web console.

Vulnerability overview

CVE-2026-101990 is a stack-based buffer overflow in the routing protocol daemon of Junos OS and Junos OS Evolved. NVD states that a remote configured BGP peer can cause an rpd crash, or remote code execution on Junos OS, by sending a flow-spec update that is selected for re-advertisement.
CVE-2026-101982 is also a stack-based buffer overflow in rpd. It allows a configured BGP or EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.
Both carry CVSS v3.1 base scores of 9.8, both were published 2026-10-14, and both sit at "Awaiting Analysis" in NVD. Neither appears in CISA's Known Exploited Vulnerabilities catalog version 2026.10.23.

Mechanism and exploitation conditions

The precondition shared by both flaws is a configured routing adjacency. In CVE-2026-101990 the peer must be able to send flow-spec updates and those updates must be selected for re-advertisement, which is a normal consequence of flow-spec distribution in a network that uses it. In CVE-2026-101982 the peer sends protocol-valid EVPN-VPWS route advertisements, and the daemon mishandles them on the path that builds the re-advertised update.
That framing changes the threat model. A BGP peer is not an anonymous internet host: it is a router, a route reflector, a customer edge device, or a service-provider endpoint explicitly configured to exchange routes. The realistic attacker is therefore someone who has compromised a peer, someone who operates a peer in a shared fabric, or someone who can establish an adjacency through a misconfiguration or an unauthenticated session.
The consequence described by the vendor is not a crash. On Junos OS, both paths are stated to reach root code execution. A buffer overflow in rpd that yields root is about as severe as a router vulnerability gets, because rpd sits at the centre of the control plane and its process holds routing state, policy references and access to the kernel programming interfaces that install forwarding entries.
The differences between the platforms matter for planning. CVE-2026-101982 is described as root code execution on Junos OS and an rpd crash on Junos OS Evolved, while CVE-2026-101990 is described as an rpd crash or remote code execution on Junos OS. Operators running both should not assume identical behaviour from the same trigger.

Impact

A compromised rpd can do more than take a device offline. It can influence what routes are installed, which means traffic steering and interception become possible without touching a single firewall filter. It can also serve as a platform for attacking neighbours, because the compromised peer is trusted by design.
A pure crash is still a serious outcome. Repeated rpd failure produces routing instability that propagates: withdrawn prefixes, reconvergence churn across the fabric, and, in networks that treat BGP as the only control plane, extended outages that are hard to attribute to a single overflowing process.

Affected products and scope

The October 2026 fixes apply to both CVEs. On Junos OS, all versions prior to 23.2R2-S7.7 are affected, along with 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3 and 26.2 before 26.2R1-S2.
On Junos OS Evolved, the affected ranges are all versions prior to 23.2R2-S7.7-EVO, 23.4 before 23.4R2-S8.11-EVO, 24.2 before 24.2R2-S5.6-EVO, 24.4 before 24.4R2-S5-EVO, 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, 26.2 before 26.2R1-S2-EVO, the 23.4X100-EVO branch, 25.2X100 before 25.2X100-D35-EVO, and 25.4X300 before 25.4X300-D40-EVO.
Practical exposure depends on protocol configuration. A device running Junos without BGP or EVPN-VPWS does not present the described path. A route reflector with dozens of peers presents many more.

Exposure context

ZoomEye data for app="Juniper" returned 343,949 matching assets. That number reflects Juniper products visible to the scanner, not Junos devices carrying BGP sessions. It is useful for sizing the population of Juniper platforms on the internet, and it should not be quoted as a count of vulnerable routers.

Remediation and validation

Patch to the fixed build, and prioritise devices that terminate BGP sessions from parties outside the operator's direct administrative control. Where the upgrade is delayed, tighten what peers are permitted to advertise using policy filters that reject unexpected flow-spec or EVPN-VPWS updates, and review whether every configured adjacency genuinely needs to exist.
After the change, confirm the release on each routing engine, verify that rpd has not logged crashes across the exposure window, and review route policy for anything that was not intended to be accepted. Because the outcome on Junos OS is root execution, any device that was unpatched and carrying an untrusted adjacency deserves an integrity review rather than a simple upgrade sign-off.

References

Top comments (0)