Junos OS and Junos OS Evolved eventd
CVE-2026-101934: Junos eventd out-of-bounds write crashes the device
A privileged local attacker can send a crafted packet to the eventd relay service and cause a denial of service (CVSS 4.4). Juniper is not aware of any malicious exploitation.
Published Updated
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS 23.2 before 23.2R2-S7.7 | 23.2R2-S7.7 or later |
| Junos OS 23.4 before 23.4R2-S8.13 | 23.4R2-S8.13 or later |
| Junos OS 24.2 before 24.2R2-S5.5 | 24.2R2-S5.5 or later |
| Junos OS 24.4 before 24.4R2-S5 | 24.4R2-S5 or later |
| Junos OS 25.2 before 25.2R2-S2 | 25.2R2-S2 or later |
| Junos OS 25.4 before 25.4R1-S3 | 25.4R1-S3, 25.4R2 or later |
| Junos OS 26.2 before 26.2R1-S2 | 26.2R1-S2, 26.2R2, 26.4R1 or later |
| Junos OS Evolved 23.2 before 23.2R2-S7.7-EVO | 23.2R2-S7.7-EVO or later |
| Junos OS Evolved 23.4 before 23.4R2-S8.11-EVO | 23.4R2-S8.11-EVO or later |
| Junos OS Evolved 24.2 before 24.2R2-S5.6-EVO | 24.2R2-S5.6-EVO or later |
| Junos OS Evolved 24.4 before 24.4R2-S5-EVO | 24.4R2-S5-EVO or later |
| Junos OS Evolved 25.2 before 25.2R2-S2-EVO | 25.2R2-S2-EVO or later |
| Junos OS Evolved 25.4 before 25.4R1-S3-EVO | 25.4R1-S3-EVO, 25.4R2-EVO or later |
| Junos OS Evolved 26.2 before 26.2R1-S2-EVO | 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO or later |
| Junos OS Evolved 25.2X100 before 25.2X100-D35-EVO | 25.2X100-D35-EVO or later |
| Junos OS Evolved 25.4X300 before 25.4X300-D40-EVO | 25.4X300-D40-EVO or later |
| Junos OS Evolved 23.4X100 | No fixed version listed |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
eventd is the Junos process that handles system events. It has an out-of-bounds write (CWE-787): a crafted packet sent to the eventd relay service can corrupt memory and cause a denial of service. Juniper found the bug internally.
The attacker has to be local and highly privileged. That is why the score is low (CVSS 3.1: 4.4, medium; CVSS 4.0: 6.7, medium). The only impact in the record is availability. CISA’s SSVC assessment is exploitation “none”, automatable “no”, technical impact “partial”.
Juniper SIRT says it is not aware of any malicious exploitation. This is a routine patch, not an emergency.
Am I affected?
You’re affected if you run Junos OS or Junos OS Evolved at a version below the fixed release for your line. See the table above for every branch.
- Junos OS: 23.2, 23.4, 24.2, 24.4, 25.2, 25.4 and 26.2 lines.
- Junos OS Evolved: the same lines, plus 25.2X100 and 25.4X300.
- Junos OS Evolved 23.4X100: the record lists no fixed version. Ask Juniper support what to do.
The record doesn’t name a configuration that must be enabled. Treat every device on an affected version as affected.
What to do
- Upgrade to the fixed release for your line, or any later release. Releases 23.2, 23.4 and 24.2 were rebuilt as respins, so use the exact versions in the table.
- Limit access in the meantime. Juniper’s workaround is to use access lists and firewall filters so that only trusted hosts and administrators can reach the device. This is good practice anyway and shouldn’t affect production traffic if your admin hosts are known.
- Review who has high-privilege access to the device. The bug needs that level of access, so the risk is mostly from a compromised or malicious admin account.
- If you run Junos OS Evolved 23.4X100, contact Juniper support. No fix is listed.
Detection
Juniper has not published indicators or log signatures for this bug, and it reports no exploitation. A crash or restart of eventd, or an unexplained device reboot, on an affected version is worth checking. Review recent administrator logins and configuration changes as well.
Indicators of compromise
Juniper reports no exploitation, and no indicators of compromise have been published.
No indicators of compromise have been published for this CVE yet. We'll add them here if the vendor or a researcher releases any. Until then, use the behaviour in Detection.
Sources
Page changelog
- Full analysis published.
KEV status, EPSS score and vendor data refreshed automatically, last on 16 Oct 2026.