Junos OS Extended Echo
CVE-2026-101980: Junos OS bug lets anyone crash the Routing Engine remotely
An integer underflow in the Junos OS kernel lets an unauthenticated network attacker crash the device when Extended Echo is configured (CVSS 4.0 9.3). Juniper knows of no exploitation and the bug is not in CISA KEV.
Published Updated
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS 23.2 before 23.2R2-S7.7 | 23.2R2-S7.7 or later |
| Junos OS 23.4 before 23.4R2-S8.13 | 23.4R2-S8.13 or later |
| Junos OS 24.2 before 24.2R2-S5.5 | 24.2R2-S5.5 or later |
| Junos OS 24.4 before 24.4R2-S5 | 24.4R2-S5 or later |
| Junos OS 25.2 before 25.2R2-S2 | 25.2R2-S2 or later |
| Junos OS 25.4 before 25.4R1-S3 | 25.4R1-S3 or later (25.4R2 also fixed) |
| Junos OS 26.2 before 26.2R1-S2 | 26.2R1-S2 or later (26.2R2 and 26.4R1 also fixed) |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An integer underflow (CWE-191) in the Junos OS kernel. When Extended Echo is configured, malformed Extended Echo requests make the kernel crash, and the Routing Engine reboots. The attacker needs no login and no user interaction, only network access to the device.
Juniper’s record describes the impact as denial of service. The CVSS scores are high (4.0: 9.3, 3.1: 9.8) because the vector rates confidentiality and integrity impact as high too, but Juniper does not describe code execution. Juniper found the bug internally.
No exploitation is known. Juniper SIRT says it is not aware of malicious use. The bug is not in CISA KEV as of catalog 2026.10.16, no public proof of concept is confirmed, and EPSS was 0.5% (39th percentile) on 2026-10-16. CISA’s SSVC assessment in the record lists exploitation “none” but automatable “yes”, so a working exploit would be easy to scan with.
Am I affected?
You’re affected if you run an unfixed Junos OS release below and have Extended Echo configured under [ system extended-echo ].
| Branch | Fixed in |
|---|---|
| 23.2 | 23.2R2-S7.7 |
| 23.4 | 23.4R2-S8.13 |
| 24.2 | 24.2R2-S5.5 |
| 24.4 | 24.4R2-S5 |
| 25.2 | 25.2R2-S2 |
| 25.4 | 25.4R1-S3 (or 25.4R2) |
| 26.2 | 26.2R1-S2 (or 26.2R2, 26.4R1) |
Check your version with show version. Then look for an extended-echo statement at the [ system ] level of your configuration. Juniper’s record lists the bug as applying when Extended Echo is configured.
For 23.2, 23.4 and 24.2, Juniper rebuilt previously published releases to carry the fix. Check that the build you install is the fixed respin listed above.
Juniper’s record names Junos OS only. It does not list specific platforms, so treat any Junos device on an affected release with this feature as in scope.
What to do
- Upgrade to the fixed release for your branch (table above), or a later one. A reboot is needed, so plan a maintenance window.
- Workaround: Juniper lists none. If you can’t upgrade yet and don’t need Extended Echo, removing the
[ system extended-echo ]configuration should take the device out of the affected state, since the bug needs it. This is our inference, not Juniper’s advice, so test it first and check what depends on it. - Limit who can reach the device on the network where you can, using your normal management-plane filtering.
- No compromise hunt is needed for this bug as such, since the impact is a crash. Unexplained Routing Engine reboots are the thing to investigate (below).
Detection
Juniper published no indicators or log signatures. What to watch for:
- Unexpected Routing Engine reboots or kernel crashes on devices with Extended Echo configured, especially repeated ones. Check system logs and any core dump or crash records on the device.
- Failover events on redundant pairs that line up with unexplained reboots.
- Inbound Extended Echo requests from addresses you don’t expect.
Indicators of compromise
No indicators have been published. Only Juniper's CVE record was checked, and it reports no exploitation.
No indicators of compromise have been published for this CVE yet. We'll add them here if the vendor or a researcher releases any. Until then, use the behaviour in Detection.
Sources
Page changelog
- Full analysis published.
KEV status, EPSS score and vendor data refreshed automatically, last on 18 Oct 2026.