CVE-2026-101982: Junos rpd buffer overflow via EVPN-VPWS, root code execution

What it is

The routing protocol daemon (rpd) has a stack-based buffer overflow (CWE-121) in its handling of EVPN-VPWS routes. A BGP peer that is already configured for EVPN can send protocol-valid route advertisements for an EVPN-VPWS service and trigger it.

On Junos OS, this can lead to code execution as root. On Junos OS Evolved, the Juniper record describes an rpd crash. The CVSS 4.0 score is 9.3 (critical), with no authentication and no user interaction.

The attacker must be a BGP/EVPN peer your device accepts routes from, so exposure depends on your peering. Juniper SIRT says it is not aware of any malicious exploitation. The CVE is not in CISA’s KEV catalog (catalog 2026.10.16), and the EPSS score is 0.6%. CISA’s ADP assessment in the record rates the bug as automatable with total technical impact. We found no public proof of concept.

This is a routing-protocol bug, not a firewall-management flaw. The record names no SRX-specific component, so don’t assume your SRX is exposed or safe: check the configuration below.

Am I affected?

You’re exposed if both are true:

1. You run Junos OS or Junos OS Evolved earlier than the fixed version for your branch (see the table above).
2. EVPN-VPWS is configured. The CVE record lists these configuration statements:

protocols bgp group <group> family evpn signaling
routing-instances <name> instance-type evpn-vpws
routing-instances <name> protocols evpn interface <interface>

Check for them in the configuration, for example with show configuration | display set | match evpn. Check your version with show version.

Not affected: releases at or above the fixed versions, and devices with no EVPN-VPWS instance. Juniper rebuilt some earlier fixed releases for 23.2, 23.4 and 24.2 (and the matching Evolved releases) as respins, so use the exact build numbers in the table.

Note: the CVE record also lists Junos OS Evolved 23.4X100 as affected without a fixed version. Ask Juniper support if you run it.

What to do

1. Upgrade to the fixed release for your branch. Pick the newest build you can qualify.
2. No workaround is known, according to the vendor record. If you can’t upgrade tonight, reduce who can reach the problem: make sure only trusted peers can establish BGP/EVPN sessions with the device, and review your BGP session authentication and neighbour filters. This is general hardening, not a Juniper-documented fix.
3. If an untrusted or compromised peer could have sent EVPN-VPWS routes to a vulnerable Junos OS device, treat it as potentially compromised: review it as you would a router breach and plan credential rotation.

Detection

No indicators of compromise have been published and no exploitation is known. Reasonable things to review, which are general practice rather than vendor guidance:

• Unexpected rpd crashes or restarts, and core files from rpd, especially on devices with EVPN-VPWS configured. On Junos OS Evolved, a crash is the expected failure.
• Unexpected EVPN-VPWS route advertisements from peers, or new BGP/EVPN sessions you didn’t configure.
• Unexpected configuration changes or new local users on the device.