PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-101963 Juniper Networks CVE debrief

A remote BGP EVPN neighbor can cause a routing protocol daemon (rpd) crash in Juniper Networks Junos OS and Junos OS Evolved when SRv6 EVPN multihoming is configured, due to an incorrect calculation vulnerability. This issue affects Junos OS and Junos OS Evolved systems that have SRv6 EVPN multihoming enabled. The vulnerability can lead to potential network instability and availability impacts. Defenders should assess exposure and prioritize verification and remediation efforts to prevent potential crashes.

Vendor
Juniper Networks
Product
Junos OS
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for Juniper Networks Junos OS and Junos OS Evolved systems, particularly those using SRv6 EVPN multihoming, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-101963 is a high-severity vulnerability in Junos OS and Junos OS Evolved that can cause an rpd crash when SRv6 EVPN multihoming is used. Defenders should prioritize verification and remediation efforts to prevent potential network instability and availability impacts.

  • Potential rpd crashes may impact network stability and availability
  • Verification of Junos OS and Junos OS Evolved versions is necessary to determine exposure
  • Upgrades to non-affected versions are required to prevent potential crashes
  • Further investigation is needed to determine if exploitation is possible

Technical summary

The vulnerability is caused by an incorrect calculation in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved. A remote BGP EVPN neighbor can exploit this vulnerability to cause an rpd crash when SRv6 EVPN multihoming is configured. The issue arises from a flawed calculation that leads to a crash of the rpd process. This can result in network instability and availability impacts. To mitigate this vulnerability, defenders should verify Junos OS and Junos OS Evolved versions to determine if they are affected and upgrade to non-affected versions.

Defensive priority

Defenders should prioritize verifying and upgrading to non-affected versions of Junos OS and Junos OS Evolved, particularly for systems using SRv6 EVPN multihoming.

Recommended defensive actions

  • Verify Junos OS and Junos OS Evolved versions to determine if they are affected by CVE-2026-101963
  • Upgrade to non-affected versions of Junos OS and Junos OS Evolved
  • Monitor systems using SRv6 EVPN multihoming for potential crashes

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and vendor advisory. However, the corpus does not provide information on exploitation or specific attack vectors.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-101963 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-101963

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-101963 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-101963

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.