Detections
Analytics

Juniper Junos OS Multiple Vulnerabilities (JSA112187)

critical Nessus Plugin ID 374265

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA112187 advisory.

 - A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring. (CVE-2026-33796)

 - A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection. (CVE-2026-102175)

 - A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. (CVE-2026-33789)

 - A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table <X>` is configured to reference a routing table that does not exist. (CVE-2026-101939)

 - A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled. (CVE-2026-101940)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Apply the relevant Junos software release referenced in Juniper advisory JSA112187

See Also

http://www.nessus.org/u?59975f8b

Plugin Details

Severity: Critical

ID: 374265

File Name: juniper_jsa112187.nasl

Version: 1.1

Type: Combined

Published: 10/30/2026

Updated: 10/30/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.38

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-33796

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L

Vulnerability Information

CPE: cpe:/o:juniper:junos

Required KB Items: Host/Juniper/JUNOS/Version

Patch Publication Date: 10/14/2026

Vulnerability Publication Date: 10/14/2026

Reference Information

CVE: CVE-2026-101927, CVE-2026-101934, CVE-2026-101939, CVE-2026-101940, CVE-2026-101941, CVE-2026-101942, CVE-2026-101943, CVE-2026-101944, CVE-2026-101945, CVE-2026-101946, CVE-2026-101948, CVE-2026-101949, CVE-2026-101951, CVE-2026-101952, CVE-2026-101954, CVE-2026-101957, CVE-2026-101959, CVE-2026-101961, CVE-2026-101962, CVE-2026-101963, CVE-2026-101964, CVE-2026-101968, CVE-2026-101969, CVE-2026-101970, CVE-2026-101971, CVE-2026-101972, CVE-2026-101974, CVE-2026-101975, CVE-2026-101976, CVE-2026-101977, CVE-2026-101979, CVE-2026-101981, CVE-2026-101982, CVE-2026-101983, CVE-2026-101984, CVE-2026-101986, CVE-2026-101987, CVE-2026-101988, CVE-2026-101989, CVE-2026-101990, CVE-2026-101991, CVE-2026-101992, CVE-2026-101993, CVE-2026-101994, CVE-2026-101995, CVE-2026-101996, CVE-2026-101999, CVE-2026-102000, CVE-2026-102011, CVE-2026-102013, CVE-2026-102015, CVE-2026-102016, CVE-2026-102017, CVE-2026-102018, CVE-2026-102019, CVE-2026-102020, CVE-2026-102021, CVE-2026-102022, CVE-2026-102024, CVE-2026-102025, CVE-2026-102026, CVE-2026-102027, CVE-2026-102028, CVE-2026-102029, CVE-2026-102030, CVE-2026-102032, CVE-2026-102033, CVE-2026-102034, CVE-2026-102035, CVE-2026-102036, CVE-2026-102039, CVE-2026-102040, CVE-2026-102041, CVE-2026-102042, CVE-2026-102043, CVE-2026-102044, CVE-2026-102047, CVE-2026-102049, CVE-2026-102050, CVE-2026-102051, CVE-2026-102052, CVE-2026-102053, CVE-2026-102054, CVE-2026-102055, CVE-2026-102056, CVE-2026-102058, CVE-2026-102059, CVE-2026-102060, CVE-2026-102061, CVE-2026-102064, CVE-2026-102065, CVE-2026-102066, CVE-2026-102067, CVE-2026-102071, CVE-2026-102175, CVE-2026-102177, CVE-2026-102178, CVE-2026-102179, CVE-2026-102180, CVE-2026-102183, CVE-2026-102184, CVE-2026-102185, CVE-2026-103993, CVE-2026-33789, CVE-2026-33795, CVE-2026-33796

IAVA: 2026-A-1144

JSA: JSA112187