CVE-2026-101948 Juniper Networks CVE debrief

Who should care

Network administrators and security teams responsible for Junos OS and Junos OS Evolved infrastructure should assess exposure and potential impact. They should verify exposure, assess potential impact, and update network infrastructure configurations as necessary. Defenders should prioritize verifying exposure and assessing potential impact on network infrastructure.

Why it matters

CVE-2026-101948 allows remote unauthenticated BGP peers to cause a denial of service in Junos OS and Junos OS Evolved via a specific BGP FlowSpec update. Defenders should verify exposure, assess potential impact, and update network infrastructure configurations as necessary.

• Denial of service via rpd crash
• Potential network infrastructure instability
• Verification of Junos OS and Junos OS Evolved versions required
• Assessment of BGP FlowSpec import policy usage necessary

Technical summary

A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a denial of service via a specific BGP FlowSpec update received by an affected BGP session. The vulnerability is caused by a NULL Pointer Dereference in the routing protocol daemon (rpd). Defenders should verify exposure and assess potential impact on network infrastructure. The CVE record and source item provide details on the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact on network infrastructure.

Recommended defensive actions

• Verify Junos OS and Junos OS Evolved versions to determine exposure
• Assess BGP FlowSpec import policy usage and potential impact
• Review and update network infrastructure configurations as necessary
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploitation or victim impact. Defenders should verify exposure and assess potential impact on network infrastructure. The vulnerability is caused by a NULL Pointer Dereference in the routing protocol daemon (rpd). Limited information is available on potential exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.