Junos OS (SRX firewalls)

CVE-2026-101963: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used

An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.

Published 14 Oct 2026Juniper Networks advisory JSA112187

ExploitedNot in CISA KEV

Ransomware useNot reportedPer CISA

SeverityHIGHCVSS 4.0 8.7

EPSS0.45%Chance of exploitation in 30 days

Public exploitNot tracked

FixAvailable

Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.

Affected and fixed versions

Product / branch	Fixed in
Junos OS 25.2	25.2R2-S2 or later
Junos OS 25.4	25.4R1-S3 or later
Junos OS 26.2	26.2R1-S2 or later
Junos OS Evolved 25.2	25.2R2-S2-EVO or later
Junos OS Evolved 25.4	25.4R1-S3-EVO or later
Junos OS Evolved 26.2	26.2R1-S2-EVO or later
Junos OS Evolved 23.4X100	See the advisory
Junos OS Evolved 25.2X100	25.2X100-D35-EVO or later
Junos OS Evolved 25.4X300	25.4X300-D40-EVO or later

Always confirm against the vendor advisory, which lists every fixed hotfix.

In short

A remote attacker can crash the routing protocol daemon on SRX firewalls by sending crafted BGP EVPN messages. This occurs when SRv6 EVPN multihoming is configured, allowing the attacker to cause a denial of service without needing to log in or interact with users.

Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.

The vendor's description

Am I affected?

[ protocols bgp <group> family evpn signaling accept-srv6-service ] [ routing-options transport-class

name

<class> color <color> ]

Workarounds

There are no known workarounds for this issue.

Exploitation

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

Sources

KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.