CVE-2026-101960

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Write in Juniper Junos OS Evolved on QFX Series

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Juniper Networks, Inc.

Description

An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101960

EUVD

EUVD-2026-101428

Affected Vendors & Products

Vendor	Product	Version / Range
Juniper	Networks	Junos OS Evolved 23.4
Juniper	Networks	Junos OS Evolved 24.2
Juniper	Networks	Junos OS Evolved 24.4
Juniper	Networks	Junos OS Evolved 25.2
Juniper	Networks	Junos OS Evolved 25.4
Juniper	Networks	Junos OS Evolved 26.2
Juniper	Networks	Junos OS Evolved 23.4X100
Juniper	Networks	Junos OS Evolved 25.2X100
Juniper	Networks	Junos OS Evolved 25.4X300

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an Out-of-bounds Write issue in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved running on QFX5240, QFX5241, and QFX5250 devices. It occurs when the device is configured for BGP global-load-balancing with more than 128 ECMP next-hops, allowing an attacker to cause the rpd to crash.

Detection Guidance

Detection requires checking if your Juniper QFX5240, QFX5241, or QFX5250 devices running Junos OS Evolved are configured for BGP global-load-balancing with more than 128 ECMP next-hops. Monitor rpd crashes or logs for out-of-bounds write errors. Juniper may provide specific diagnostic commands in their security advisories.

Impact Analysis

The vulnerability can lead to a denial-of-service condition by crashing the routing protocol daemon, disrupting network traffic and potentially causing outages on affected devices.

Compliance Impact

This vulnerability causes an rpd crash due to an out-of-bounds write in BGP global-load-balancing with over 128 ECMP next-hops. It may lead to service disruption but does not directly impact data confidentiality or integrity. Compliance with GDPR or HIPAA depends on system availability and data protection measures rather than this specific issue.

Mitigation Strategies

Disable BGP global-load-balancing if configured with more than 128 ECMP next-hops on affected QFX5240, QFX5241, or QFX5250 devices running Junos OS Evolved.

Hi! I’m here to help you understand CVE-2026-101960. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70