/
← Voltar ao feed
high

CERT-FR: Multiple vulnerabilities in Juniper Networks Junos OS, Junos OS Evolved and Cloud-Native Router, including SRX ADVPN RCE

1 fonte(s) · 1 atualização(ões) · publicado 14/10/2026 21:00 · coletado há 3 dias

CERT-FR advisory CERTFR-2026-AVI-1322, published 15 October 2026, reports multiple vulnerabilities in Juniper Networks products, based on the vendor's October 2026 security bulletins of 14 October (JSA112168 to JSA112250). The flaws affect Junos OS, Junos OS Evolved (including MX and SRX Series) and Juniper Cloud-Native Router. According to CERT-FR, they allow remote arbitrary code execution, privilege escalation, security policy bypass, data integrity and confidentiality compromise, and remote denial of service. The advisory does not state that any flaw is exploited in the wild and gives no IOCs or attribution. The most serious named issue is a remote code execution in SRX Series in an ADVPN scenario, triggered by a malformed message from a peer (CVE-2026-102084).

Detalhes técnicos

  • Named issues in the bulletin titles:
    • CVE-2026-102084: SRX Series, ADVPN scenario, malformed peer message leads to remote code execution.
    • CVE-2026-102079: MX Series, missing authorization on specific request CLI commands allows command injection.
    • CVE-2026-102085: Junos OS Evolved, an inadvertently exposed port can be reached by an attacker.
    • CVE-2026-102087: a specific valid BGP-LS attribute in a traffic engineering scenario crashes rpd.
    • CVE-2026-102086 and CVE-2026-102081: SRX flowd crash (SecIntel and DGA DNS queries) and SPC3 memory leak under high session churn.
    • CVE-2026-102078: SRX flowd crash from high-volume DNS over TCP.
    • CVE-2026-102083: SRX crash with WebFiltering under prolonged HTTP session load.
    • CVE-2026-102082: SRX PFE crash on a specific TLS message with session resumption.
    • CVE-2026-102080: MX malformed SyncE or PTP clock input causes continuous RE switchover.
    • CVE-2026-102077: MX with SPC3, malformed packets in a NAT scenario cause resource leaks and traffic stops.
  • The advisory also references dozens of other CVEs (CVE-2026-101927 to CVE-2026-102072, plus older ones such as CVE-2023-2253, CVE-2024-24789, CVE-2024-52533, CVE-2024-7264) covered by the multi-vulnerability bulletins JSA112185, JSA112186, JSA112187, JSA112188, JSA112196 and JSA112250. The CVE list in the source is truncated.
  • Affected: Junos OS and Junos OS Evolved branches 23.2, 23.4, 24.2, 24.4, 25.2, 25.4 and 26.2 before the fixed releases (e.g. 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2); Juniper Cloud-Native Router before 26.2. Per-platform fixed versions for MX and SRX Series are listed in the advisory.

Remediação

  • Consult the Juniper security bulletins (JSA112168 to JSA112250) and upgrade to the fixed releases for your branch and platform.
  • Prioritize SRX Series devices with ADVPN configured and MX Series devices exposed to CLI command injection.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 14/10/2026 21:00 · coletado 20/10 16:32 primeiro registro

    CERT-FR: Multiple vulnerabilities in Juniper Networks Junos OS, Junos OS Evolved and Cloud-Native Router, including SRX ADVPN RCE

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1322, published 15 October 2026, reports multiple vulnerabilities in Juniper Networks products, based on the vendor's October 2026 security bulletins of 14 October (JSA112168 to JSA112250). The flaws affect Junos OS, Junos OS Evolved (including MX and SRX Series) and Juniper Cloud-Native Router. According to CERT-FR, they allow remote arbitrary code execution, privilege escalation, security policy bypass, data integrity and confidentiality compromise, and remote denial of service. The advisory does not state that any flaw is exploited in the wild and gives no IOCs or attribution. The most serious named issue is a remote code execution in SRX Series in an ADVPN scenario, triggered by a malformed message from a peer (CVE-2026-102084).

    Technical Details

    • Named issues in the bulletin titles:
      • CVE-2026-102084: SRX Series, ADVPN scenario, malformed peer message leads to remote code execution.
      • CVE-2026-102079: MX Series, missing authorization on specific request CLI commands allows command injection.
      • CVE-2026-102085: Junos OS Evolved, an inadvertently exposed port can be reached by an attacker.
      • CVE-2026-102087: a specific valid BGP-LS attribute in a traffic engineering scenario crashes rpd.
      • CVE-2026-102086 and CVE-2026-102081: SRX flowd crash (SecIntel and DGA DNS queries) and SPC3 memory leak under high session churn.
      • CVE-2026-102078: SRX flowd crash from high-volume DNS over TCP.
      • CVE-2026-102083: SRX crash with WebFiltering under prolonged HTTP session load.
      • CVE-2026-102082: SRX PFE crash on a specific TLS message with session resumption.
      • CVE-2026-102080: MX malformed SyncE or PTP clock input causes continuous RE switchover.
      • CVE-2026-102077: MX with SPC3, malformed packets in a NAT scenario cause resource leaks and traffic stops.
    • The advisory also references dozens of other CVEs (CVE-2026-101927 to CVE-2026-102072, plus older ones such as CVE-2023-2253, CVE-2024-24789, CVE-2024-52533, CVE-2024-7264) covered by the multi-vulnerability bulletins JSA112185, JSA112186, JSA112187, JSA112188, JSA112196 and JSA112250. The CVE list in the source is truncated.
    • Affected: Junos OS and Junos OS Evolved branches 23.2, 23.4, 24.2, 24.4, 25.2, 25.4 and 26.2 before the fixed releases (e.g. 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2); Juniper Cloud-Native Router before 26.2. Per-platform fixed versions for MX and SRX Series are listed in the advisory.

    Remediation

    • Consult the Juniper security bulletins (JSA112168 to JSA112250) and upgrade to the fixed releases for your branch and platform.
    • Prioritize SRX Series devices with ADVPN configured and MX Series devices exposed to CLI command injection.