CVE-2026-101963

Awaiting Analysis Awaiting Analysis - Queue

Incorrect Calculation in Juniper Junos OS rpd

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Juniper Networks, Inc.

Description

An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101963

EUVD

EUVD-2026-101315

Affected Vendors & Products

Vendor	Product	Version / Range
Juniper	Networks	Junos OS 25.2
Juniper	Networks	Junos OS 25.4
Juniper	Networks	Junos OS 26.2
Juniper	Networks	Junos OS Evolved 25.2
Juniper	Networks	Junos OS Evolved 25.4
Juniper	Networks	Junos OS Evolved 26.2
Juniper	Networks	Junos OS Evolved 23.4X100
Juniper	Networks	Junos OS Evolved 25.2X100
Juniper	Networks	Junos OS Evolved 25.4X300

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-682	The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Attack-Flow Graph

Executive Summary

This vulnerability is an Incorrect Calculation issue in Juniper Networks Junos OS and Junos EVO routing protocol daemon (rpd). It occurs when a remote BGP EVPN neighbor triggers an rpd crash if SRv6 EVPN multihoming is configured.

Detection Guidance

This vulnerability can be detected by monitoring for rpd crashes or unexpected behavior in Junos OS/EVO systems with SRv6 EVPN multihoming configured. Check logs for rpd crashes and verify BGP EVPN neighbor stability. Juniper may provide specific diagnostic commands in their advisories.

Impact Analysis

A remote attacker could exploit this to cause a denial of service by crashing the rpd service, disrupting network routing and connectivity.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it is a technical flaw in routing protocol functionality rather than a data protection or privacy issue.

Mitigation Strategies

Disable SRv6 EVPN multihoming if configured, as this is the specific feature triggering the vulnerability. Update Junos OS or Junos EVO to the latest patched version immediately. Monitor rpd logs for crashes and isolate affected BGP EVPN neighbors until mitigation is complete.

Hi! I’m here to help you understand CVE-2026-101963. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70