Juniper's October 2026 Security Release: 153 Junos CVEs, 15 Critical, and What to Patch First

Juniper Networks published its October 2026 security release on October 14, and it is one of the largest the company has shipped: 153 CVEs, all assigned by Juniper's SIRT and all affecting Junos OS, Junos OS Evolved or both. By CVSS 3.1 score, 15 are critical, 75 high, 61 medium and 2 low. Juniper's SIRT says it is not aware of malicious exploitation of the critical flaws, and as of October 16 none of the 153 appear in CISA's Known Exploited Vulnerabilities catalog. The upside for admins is that the fixes converge on the same set of releases, so one upgrade per device clears most of the list.

Most of the CVEs sit in the omnibus bulletin JSA112187, which alone covers 106 of them, with further batches in JSA112186 (SRX Series), JSA112188, JSA112250 (Junos OS Evolved) and JSA112196 (MX Series), plus a dozen single-issue bulletins. THE JDNEER also covered the MX Series kmd flaw and the J-Web bugs when the release landed.

The critical flaws

The fifteen critical issues, each rated 9.8, fall into a few groups.

BGP and the routing daemon. Five stack overflows in rpd can be triggered by BGP traffic: CVE-2026-33789 and CVE-2026-33796 through the BGP Monitoring Protocol, CVE-2026-101990 and CVE-2026-102178 through flowspec re-advertisement, and CVE-2026-101982 through EVPN-VPWS routes. Most can lead to root code execution on Junos OS. Only CVE-2026-33789 has a workaround: disabling BMP or avoiding the inet flow family. THE JDNEER breaks these down in a separate deep dive on the BGP bugs.

J-Web. Four flaws in the built-in web interface need no login: CVE-2026-101986 bypasses authentication on all supported trains, CVE-2026-101983 is an httpd overflow when a J-Web virtual domain is configured, and CVE-2026-101954 and CVE-2026-101956 allow full takeover on 25.2 and later. None has a workaround. More detail is in THE JDNEER's J-Web deep dive.

SRX Series. CVE-2026-33792 lets an unauthenticated attacker run code as root through a crafted packet on a configured GRE tunnel, and CVE-2026-101950 is a heap overflow on interfaces configured for Secure Vector Routing. The same SRX bulletin also fixes CVE-2026-33798 (8.8), root code execution over chassis cluster fabric links from an adjacent attacker.

MX Series. CVE-2026-102182 is an overflow in kmd, the IKE key management daemon, that allows unauthenticated root code execution through certificate-based IKE packets.

Everything else critical. CVE-2026-102175 is a heap overflow in the sdxd service-deployment daemon reachable by anyone who can control or intercept its server connection, CVE-2026-102031 is a TACACS+ command injection on Junos OS Evolved that turns a low-privileged user into root, and CVE-2026-101980 is a kernel crash triggered by malformed Extended Echo requests where that feature is configured.

Many of these only bite when a specific feature is configured, such as BMP, flowspec, J-Web, GRE or Secure Vector Routing. That is worth checking first, but Juniper lists no workaround for most of them, so the upgrade is the real fix.

Are you affected?

A quick way to check exposure, based on the conditions Juniper lists in its advisories. Run these from operational mode on each device.

• ☐ Run show version and compare the Junos release against the fixed builds for your train. Anything older than the fixed build in your train is affected.
• ☐ Run show configuration routing-options bmp and show configuration protocols bgp | display set | match bmp, since BMP can also be set per group or neighbor. Any configured BMP station means CVE-2026-33789 and CVE-2026-33796 apply.
• ☐ Run show configuration | display set | match "family inet6? flow|inet-vpn flow" to cover every routing instance. Any match means the flowspec bugs, CVE-2026-101990 and CVE-2026-102178, apply.
• ☐ Run show configuration system services web-management. If HTTP or HTTPS is configured, J-Web is on and CVE-2026-101986 applies; on 25.2, 25.4 or 26.2, so do CVE-2026-101954 and CVE-2026-101956.
• ☐ Look at which interfaces J-Web listens on and whether those are reachable from the internet or other untrusted networks. Reachable means exposed to an unauthenticated attacker.
• ☐ SRX: run show chassis cluster status. A configured chassis cluster means the fabric flaws CVE-2026-33798, CVE-2026-101936 and CVE-2026-101937 apply.
• ☐ SRX: run show configuration interfaces | display set | match "^set interfaces gr-". Any configured gr- unit means CVE-2026-33792 applies. The physical gr-0/0/0 interface on its own is not exposure.
• ☐ SRX: run show configuration services security-intelligence. A configured feed means the ipfd flaws, including CVE-2026-101997, apply.
• ☐ SRX: check whether Secure Vector Routing, UTM Anti-Spam SBL or remote-access VPN with JIMS identity publishing are in use. Each is a precondition for one of the SRX CVEs.
• ☐ MX: check whether IPsec with certificate-based IKE is configured. If so, CVE-2026-102182 applies.

How to patch

For most CVEs in this release, the fixed Junos OS releases are 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2, with later builds such as 25.4R2 and 26.2R2 also fixed. On Junos OS Evolved, the matching fixes are 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO and 26.2R1-S2-EVO, plus 25.2X100-D35-EVO and 25.4X300-D40-EVO. A handful of single-issue bulletins were fixed in earlier maintenance releases, so check the bulletin linked in the table for your train.

• Start with internet-facing devices and anything that exposes J-Web, terminates IPsec or GRE, or exchanges BGP flowspec, BMP or EVPN routes with outside networks.
• Stay in the release train you already run and move to its fixed build, after checking Juniper's download page for your platform.
• While you schedule windows, keep J-Web and other management services reachable only from trusted management hosts.
• Hardware on end-of-life releases will not get fixes. Juniper does not assess those releases, so treat such devices as exposed if they use the affected features.

Every CVE in the October 2026 release

Sorted by CVSS 3.1 score. Each CVE links to its NVD record and each bulletin to Juniper's support portal. Components are taken from Juniper's own descriptions.

Sources: Juniper Networks security bulletins on its support portal (some pages require a Juniper account), Juniper's CVE records as published to CVE.org and the NVD, and CISA's Known Exploited Vulnerabilities catalog, checked October 16, 2026.