CVE-2026-101984 Juniper Networks CVE debrief

Who should care

Network administrators and security teams responsible for managing Juniper Networks devices running Junos OS and Junos OS Evolved should assess their exposure and prioritize patching or mitigating this vulnerability to prevent potential denial-of-service attacks from adjacent BGP peers.

Why it matters

CVE-2026-101984 is a medium-severity vulnerability in Junos OS and Junos OS Evolved that can cause a denial of service when labeled-unicast aggregate-label is configured. Network administrators and security teams should assess their exposure, prioritize patching or mitigating this vulnerability, and implement network segmentation and monitoring to limit exposure and detect potential attacks.

• Denial of service attacks from adjacent BGP peers may cause network disruptions.
• Verification of configurations and patch levels is necessary to ensure protection.
• Network segmentation and monitoring may be required to limit exposure and detect potential attacks.
• Remediation priority is high for networks with high exposure to adjacent BGP peers.

Technical summary

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured. The vulnerability affects various versions of Junos OS and Junos OS Evolved, prior to specific fixed versions.

Defensive priority

Network administrators should prioritize patching or mitigating this vulnerability to prevent potential denial-of-service attacks from adjacent BGP peers.

Recommended defensive actions

• Review and apply patches from Juniper Networks for affected Junos OS and Junos OS Evolved versions.
• Implement network segmentation to limit exposure to adjacent BGP peers.
• Monitor network traffic and rpd daemon logs for potential attacks.
• Verify configurations and ensure labeled-unicast aggregate-label is not unnecessarily exposed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.