External risk intelligence

Juniper Junos OS rpd Stack Buffer Overflow Allows Root Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-101982

The vulnerability exists in the BGP/EVPN routing protocol daemon. While this protocol operates over a network, BGP sessions are typically restricted to direct peerings between specific infrastructure routers or enterprise gateways using explicit trust configurations. It is not a public-facing service intended for general internet exposure or client access.

Buffer Overflow

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recently identified vulnerability in Juniper Networks' Junos OS and Junos OS Evolved software affects the routing protocol daemon, potentially allowing a configured BGP/EVPN peer to execute code or cause a service disruption. The main concern at this time is to confirm whether this specific technology is in use within our environment and if it is exposed to potentially malicious actors.

A routing software flaw can lead to code execution.
Crucial for understanding potential network infrastructure exposure.
Verify if this technology is deployed and exposed.

Attack Path

How an attacker could exploit the issue

An attacker with a pre-existing BGP/EVPN peering could send specially crafted route advertisements. This would target the routing protocol daemon, potentially leading to unauthorized code execution or service disruption.

Requires a configured BGP/EVPN peer.
Triggered by protocol-valid route advertisements.
Risk of root code execution or daemon crash.

Live Threat

Current exploitation, exposure, and threat context

A configured BGP/EVPN peer could cause root code execution or a service crash by sending specially crafted route advertisements. This could affect the integrity and availability of network routing services when supported by the advisory.

Routing protocol daemon and its functions.
Via specially crafted route advertisements.
Potential for root code execution or service crash.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Juniper Networks' routing protocol daemon may allow a configured BGP/EVPN peer to achieve root code execution or cause a denial of service. Ownership will likely fall to the network infrastructure or security teams responsible for managing BGP/EVPN peering and routing policies. The immediate first step is to identify all BGP/EVPN peers and confirm if any are advertising routes for EVPN-VPWS services.

Network infrastructure teams own the issue.
Verify EVPN-VPWS route advertisements from peers.
Plan controlled remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Junos OS routing protocol daemon (rpd)?

The rpd is the core software component in Juniper Networks' Junos OS and Junos OS Evolved responsible for managing routing protocols. It maintains the routing table and handles communication with other network devices to determine data paths. Think of it as the control center that ensures packets find their correct destination across a network infrastructure.

What does CWE-121 mean for CVE-2026-101982?

CWE-121 refers to a stack-based buffer overflow. In this context, it means the routing protocol daemon does not correctly handle the amount of data it receives in route advertisements. Because the software tries to write more information into a specific memory area than it can hold, it may crash or allow an attacker to hijack the system's execution flow.

How is this vulnerability triggered?

An attacker must be a configured BGP/EVPN peer to reach the vulnerable code. The issue is triggered by sending specially crafted, yet protocol-valid, route advertisements for an EVPN-VPWS service. If you are not using BGP/EVPN peering, or if your devices do not participate in EVPN-VPWS service exchanges, this specific vulnerability cannot be triggered.

Is my network at risk from this CVE?

Halo Surface Signal indicates the risk is unlikely for most because BGP sessions usually involve direct, trusted peering between infrastructure gateways. While this vulnerability is technically network-accessible, it requires a pre-existing, configured peering relationship. It is not an internet-facing service open to the general public.

What should I do if I run Junos OS?

First, identify all devices running Junos OS or Junos OS Evolved that are configured for BGP/EVPN. Next, verify if any of those peers are currently exchanging routes for EVPN-VPWS services. If they are, consult the official Juniper Networks support portal for the specific maintenance updates or configuration changes required to mitigate this risk.

References

supportportal.juniper.net/JSA112187

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.