High priorityDisclosed

Advisory · CVE-2026-101945

Integer overflow in Junos rpd lets an EVPN peer disrupt control-plane adjacencies

An integer overflow or wraparound vulnerability in the rpd process of Junos OS and Junos OS Evolved lets a remote attacker with an established EVPN BGP peering relationship cause a denial of service via EVPN BGP route processing, disrupting control-plane adjacencies on EVPN-enabled routing instances. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-101945
CWE-190
Action timing
Immediate
ELI5

Explain it like I’m five

Route processing arithmetic wraps, adjacencies drop, and the EVPN fabric feels it as an outage, not a bug.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Trigger input

    An attacker sends the crafted protocol traffic described for CVE-2026-101945.

  2. 02Weakness trips

    The daemon mishandles the input through the integer overflow or wraparound weakness.

  3. 03Impact lands

    The routing or control-plane daemon crashes or misbehaves as described.

What happened

Juniper disclosed CVE-2026-101945 in its October 2026 security release: an integer overflow or wraparound vulnerability (CWE-190) in rpd. It affects EVPN-enabled routing instances and can disrupt control-plane adjacencies through EVPN BGP route processing by an established peer.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for adjacency drops and rpd restarts on EVPN-enabled routing instances.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Two EVPN integer overflows landed in the same release (with CVE-2026-101944). Patch once, verify adjacencies after.