Act nowDisclosed

Advisory · CVE-2026-101982

Stack overflow in Junos rpd lets a BGP/EVPN peer run code as root via EVPN-VPWS routes

A stack-based buffer overflow in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets a configured BGP/EVPN peer execute root code on Junos OS, or crash rpd on Junos OS Evolved, via protocol-valid route advertisements for an EVPN-VPWS service. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-101982
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

The route advertisement is protocol-valid, so nothing upstream filters it, and it still overflows the daemon that receives it.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01EVPN peer advertises

    A configured BGP/EVPN peer sends protocol-valid EVPN-VPWS route advertisements.

  2. 02rpd stack overflows

    rpd mishandles the advertisement and its stack buffer overflows.

  3. 03Root code or crash

    On Junos OS the overflow can execute code as root; on Evolved it crashes rpd.

What happened

Juniper disclosed CVE-2026-101982 in its October 2026 security release: a stack-based buffer overflow (CWE-121) in rpd affecting Junos OS and Junos OS Evolved. A configured BGP/EVPN peer can trigger it with protocol-valid route advertisements for an EVPN-VPWS service, reaching root code execution on Junos OS or an rpd crash on Junos OS Evolved.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for rpd crashes or restarts following EVPN-VPWS route advertisements from peers.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

EVPN fabrics concentrate trust in peers. Patch the fabric and review which peers can advertise VPWS services.