CVE-2026-101996 Juniper Networks CVE debrief

Who should care

Network administrators and security teams responsible for Juniper Networks Junos OS and Junos OS Evolved devices, especially those configured for MC-LAG/ICCP, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-101996 is a denial-of-service vulnerability in Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP. Defenders should prioritize patching or mitigating this vulnerability to prevent service disruption.

• Denial-of-service vulnerability requires patching or mitigation to prevent l2ald crashes
• Adjacent attackers can exploit this vulnerability to cause service disruption
• Configurations using MC-LAG/ICCP are potentially vulnerable and require verification
• Remediation priority is high for affected Junos OS and Junos OS Evolved versions

Technical summary

The l2ald daemon in Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP is vulnerable to a denial-of-service attack. An adjacent attacker can cause a crash via an inconsistent ICCP peer message. This issue affects various versions of Junos OS and Junos OS Evolved, prior to 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, and 26.2R1-S2. Defenders should prioritize patching or mitigating this vulnerability to prevent service disruption.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP.

Recommended defensive actions

• Review and apply patches for affected Junos OS and Junos OS Evolved versions
• Implement mitigations for MC-LAG/ICCP configurations
• Monitor for suspicious ICCP peer messages
• Verify configurations and inventory for affected devices

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the vulnerability. The Juniper Networks support portal also provides additional information on the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.