CVE-2026-102060 Juniper Networks CVE debrief

Who should care

Network administrators and security teams responsible for managing Junos OS and Junos OS Evolved systems should assess exposure and prioritize verification and updates to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-102060 is a medium-severity vulnerability in Junos OS and Junos OS Evolved that can cause a denial of service via a routing daemon crash. Network administrators and security teams should prioritize verifying and updating affected versions to prevent potential attacks.

• Denial of service via routing daemon crash
• Potential network instability or downtime
• Need for verification and updates of affected versions
• Possible impact on network security posture

Technical summary

A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network. Affected versions include Junos OS versions prior to 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, and 26.2R1-S2, as well as Junos OS Evolved versions prior to 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, and 26.2R1-S2-EVO.

Defensive priority

Network administrators and security teams should prioritize verifying and updating affected Junos OS and Junos OS Evolved versions to prevent potential denial-of-service attacks.

Recommended defensive actions

• Verify and update affected Junos OS and Junos OS Evolved versions
• Monitor network for suspicious IGMPv3 membership reports
• Implement compensating controls to mitigate potential denial-of-service attacks
• Review network configurations for potential exposure
• Conduct regular security audits to identify vulnerable systems
• Track and prioritize patching of affected systems
• Document and report on vulnerability management efforts

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and potential impact. However, there is limited information on exploitation or victim data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.