Five Critical BGP Bugs Let Peers Take Over Juniper Routers

Five of the fifteen critical flaws in Juniper Networks' October 14 security release live in the same place: rpd, the routing protocol daemon at the heart of Junos OS and Junos OS Evolved. All five are stack-based buffer overflows rated CVSS 9.8 (9.2 or 9.3 under CVSS 4.0), and all five are triggered by BGP traffic. On Junos OS, most of them can lead to code execution with root privileges on the routing engine. Juniper's SIRT says it is not aware of malicious exploitation of any of them, and none appear in CISA's Known Exploited Vulnerabilities catalog. They are part of a much larger batch that THE JDNEER summarized in its overview of the full release.

The one that needs the least from an attacker is CVE-2026-33789. Juniper describes it as letting an unauthenticated BGP peer crash rpd and potentially run root-level commands through crafted route updates when the BGP Monitoring Protocol (BMP) is enabled. It is also the only one of the five with a workaround: Juniper says disabling BMP or avoiding the inet flow address family closes the hole. CVE-2026-33796 is a second BMP bug, this time in route monitoring, that lets a configured external BGP neighbor execute arbitrary commands as root. Juniper lists no workaround for it.

Two more involve flowspec, the BGP extension many operators use to push filtering rules for DDoS mitigation. CVE-2026-101990 lets a configured BGP peer crash rpd, or achieve remote code execution on Junos OS, by sending a flowspec update that the router selects for re-advertisement. CVE-2026-102178 hits the same re-advertisement path but only when BGP update-threading is enabled, and can lead to routing engine compromise. The fifth, CVE-2026-101982, is reachable by a configured BGP/EVPN peer through route advertisements for an EVPN-VPWS service, causing root code execution on Junos OS or an rpd crash on Junos OS Evolved.

Four of the five require a configured peer, which narrows the attack surface to someone who controls or compromises a neighbor. For providers exchanging flowspec or EVPN routes with other networks, though, that neighbor sits outside their trust boundary by design, and a compromised peer upstream can be enough.

Are you affected?

A quick way to check exposure, based on the conditions Juniper lists in its advisories. Run these from operational mode on each device.

• ☐ Run show version and compare the Junos release against the fixed builds for your train. Anything older than the fixed build in your train is affected.
• ☐ Run show configuration routing-options bmp and show configuration protocols bgp | display set | match bmp, since BMP can also be set per group or neighbor. Any configured BMP station means CVE-2026-33789 and CVE-2026-33796 apply.
• ☐ Run show configuration | display set | match "family inet6? flow|inet-vpn flow" to cover every routing instance. Any match means the flowspec bugs, CVE-2026-101990 and CVE-2026-102178, apply.
• ☐ Run show configuration system processes routing bgp. If update-threading is set alongside flowspec, CVE-2026-102178 applies.
• ☐ Run show configuration routing-instances | display set | match evpn-vpws. Any EVPN-VPWS instance with BGP EVPN signaling means CVE-2026-101982 applies.
• ☐ Check which peers can send flowspec, BMP-monitored or EVPN routes. Peers outside your administrative control raise the risk.

Patch guidance

All five share the same fixed releases. For Junos OS, those are 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2. For Junos OS Evolved, they are 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO and 26.2R1-S2-EVO, plus 25.2X100-D35-EVO and 25.4X300-D40-EVO. Juniper lists 23.4X100 Evolved builds as affected without a fixed version in the CVE records.

• Check whether BMP (routing-options bmp), flowspec (family inet flow or inet6 flow), BGP update-threading or EVPN-VPWS instances are configured. Those features decide your exposure.
• If BMP is on and you cannot upgrade right away, Juniper's own workaround for CVE-2026-33789 is to disable BMP or avoid configuring inet flow.
• Prioritize routers that accept flowspec or EVPN routes from external peers, and review which peers are allowed to send those families at all.

The bulletin for all five is JSA112187.

Sources: Juniper Networks security bulletins on its support portal (some pages require a Juniper account), Juniper's CVE records as published to CVE.org and the NVD, and CISA's Known Exploited Vulnerabilities catalog, checked October 16, 2026.