External risk intelligence

Junos OS TWAMP Client Service Disruption

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-102070

The vulnerability affects the Two-Way Active Measurement Protocol (TWAMP) client, which is used for performance monitoring between network devices. While network-reachable, these control plane protocols are typically deployed within isolated management networks or between specific infrastructure endpoints, making public internet exposure uncommon in standard deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability within the Two-Way Active Measurement Protocol (TWAMP) client in Juniper Networks Junos OS. An unauthenticated attacker could exploit this to disrupt the rmopd service. The main concern is to confirm if this specific protocol is in use and exposed in your environment.

Protocol flaw can cause service disruption.
Important for network performance monitoring systems.
Verify if TWAMP client is actively used.

Attack Path

How an attacker could exploit the issue

An attacker can disrupt the `rmopd` service by sending a specially crafted TCP packet over the network. This vulnerability affects the Two-Way Active Measurement Protocol (TWAMP) client, and since no authentication is required, an unauthenticated attacker can trigger the issue. The attack could lead to denial of service for the affected service.

No authentication or privileges required.
Triggered by a specific network packet.
Leads to denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Junos OS TWAMP client could allow an unauthenticated attacker to disrupt the `rmopd` service. This disruption could occur when the TWAMP client is exposed to a network, potentially impacting the device's ability to perform network performance measurements.

Service disruption of `rmopd`.
Unauthenticated network attacker.
Impacts network measurement capability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical vulnerability in the TWAMP client of Juniper Networks Junos OS is likely a concern for network infrastructure and platform teams responsible for network device management. The first practical step is to identify all Juniper devices running Junos OS that are configured to use the TWAMP client, determine if these are exposed to the network and whether they are business-critical, and then confirm the specific owner accountable for the affected systems to plan remediation.

Network and platform teams own the issue.
Verify TWAMP client exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TWAMP client in Junos OS?

The Two-Way Active Measurement Protocol (TWAMP) client is a component of Juniper Networks' Junos OS. Network administrators use it to measure IP performance metrics, such as latency and jitter, between network devices. It functions as part of the control plane to ensure high-quality connectivity across infrastructure.

What does CWE-617 mean for CVE-2026-102070?

CWE-617 refers to a Reachable Assertion vulnerability. In plain terms, the software contains a check that, if triggered by specific unexpected input, causes the program to intentionally stop running to prevent unpredictable behavior. In this CVE, a malformed TCP packet forces the TWAMP client to trigger this assertion, resulting in a denial of service for the rmopd service.

How can an attacker trigger this TWAMP vulnerability?

An unauthenticated attacker sends a specially crafted TCP packet directly to the TWAMP client over the network. The bug is specifically linked to the processing of this packet type. It is important to note that typical, valid TWAMP traffic used for legitimate performance monitoring does not trigger this disruption; the issue requires a malformed packet designed to force the error.

Is my device at risk based on Halo Surface Signal?

While the vulnerability is network-reachable, Halo Surface Signal notes that TWAMP is typically confined to isolated management networks or restricted infrastructure paths. Because it is rarely exposed to the public internet in standard deployments, the likelihood of an external, internet-based attack is considered low for most organizations.

What should I do if I run Junos OS?

Begin by auditing your infrastructure to determine if the TWAMP client is actively enabled on your Juniper devices. Prioritize identifying systems where this feature is configured, assess whether those specific network paths are accessible to unauthorized users, and coordinate with your network operations team to establish a patching or mitigation plan for affected, business-critical assets.

References

supportportal.juniper.net/JSA112188

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.