JO
Network Security
Junos OS
On CISA KEVExploited in the wild
931
CVEs
8
On KEV
10.0
Max CVSS
141
New 30D
Severity mix
Critical 52High 392Medium 56Low 0
Watch
Add Junos OS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-5477 In wildKEV | 7.5 | Jul 29 | ISC BIND Data Processing Errors Vulnerability Affected: before 12.1; 13.1 before 13.2; 12.1; 12.1; 12.1r; 12.1x44; +34 more |
| CVE-2026-101981 | 8.8 | Oct 14 | Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when LDP is enabled Affected: 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2 |
| CVE-2026-101979 | 8.8 | Oct 14 | Junos OS and Junos OS Evolved: A network attacker causes root-level code execution or denial of service when SNMP and AAA are enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-33798 | 8.8 | Oct 14 | Junos OS and Junos OS Evolved: SRX Series: An attacker causes remote code execution when SRX chassis-cluster is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102176 | 8.8 | Oct 14 | Junos OS: Specific packets cause SDK service crash or Routing Engine compromise when the SDK service and JDAF is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102174 | 8.8 | Oct 14 | Junos OS: SRX Series: An authenticated remote-access VPN client causes iked denial of service or root-level code execution when JIMS identity publishing is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102061 | 8.8 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes root code execution when SZTP DHCP provisioning is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102059 | 8.8 | Oct 14 | Junos OS and Junos OS Evolved: EX Series, SRX Series, QFX Series: A rogue DHCP server causes root-level command execution when the phone-home client processes specific information Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102055 | 8.8 | Oct 14 | Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remote code execution and denial of service when enhanced CFM is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102052 | 8.8 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-client feature is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102050 | 8.8 | Oct 14 | Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of service when LLDP is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102049 | 8.8 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code execution when Unified Access Policy is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102015 | 8.8 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes root code execution when 802.1X authentication is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102014 | 8.8 | Oct 14 | Junos OS: An attacker causes authd to crash when subscriber RADIUS authentication is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102069 | 8.8 | Oct 14 | Junos OS: An ICCP peer causes dot1xd to crash when dot1x synchronization is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-103994 | 8.8 | Oct 14 | Junos OS: A crafted OVSDB message crashes vgd and allows remote code execution Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-33785 | 8.8 | Apr 9 | Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands in a JDM/CSDS scenario Affected: 24.4 before 24.4R2-S3; 25.2 before 25.2R2 |
| CVE-2024-39565 | 8.8 | Jul 10 | An Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in J-Web shipped with Juniper Networks Junos OS allows an unauthenticated,… Affected: before 21.2; 21.2; 21.2; 21.2; 21.2; 21.2; +34 more |
| CVE-2023-44182 | 8.8 | Oct 13 | An Unchecked Return Value vulnerability in the user interfaces to the Juniper Networks Junos OS and Junos OS Evolved, the CLI, the XML API, the XML Management Protocol, the… Affected: before 20.4; 20.4; 20.4; 20.4; 20.4; 20.4; +34 more |
| CVE-2022-22246 | 8.8 | Oct 18 | Junos OS: PHP file inclusion vulnerability in J-Web Affected: before 19.1R3-S9; 19.2 before 19.2R3-S6; 19.3 before 19.3R3-S6; 19.4 before 19.4R2-S7, 19.4R3-S8; 20.1 before 20.1R3-S5; 20.2 before 20.2R3-S5; +7 more |
| CVE-2021-31385 | 8.8 | Oct 19 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in J-Web of Juniper Networks Junos OS allows any low-privileged authenticated… Affected: 12.3; 12.3; 12.3; 12.3; 12.3; 12.3; +34 more |
| CVE-2021-31372 | 8.8 | Oct 19 | An Improper Input Validation vulnerability in J-Web of Juniper Networks Junos OS allows a locally authenticated J-Web attacker to escalate their privileges to root over the target… Affected: through 18.2; 18.3; 18.3; 18.3; 18.3; 18.3; +34 more |
| CVE-2021-31354 | 8.8 | Oct 19 | An Out Of Bounds (OOB) access vulnerability in the handling of responses by a Juniper Agile License (JAL) Client in Juniper Networks Junos OS and Junos OS Evolved, configured in… Affected: 19.2; 19.2; 19.2; 19.2; 19.2; 19.2; +34 more |
| CVE-2021-31350 | 8.8 | Oct 19 | An Improper Privilege Management vulnerability in the gRPC framework, used by the Juniper Extension Toolkit (JET) API on Juniper Networks Junos OS and Junos OS Evolved, allows a… Affected: 18.4; 18.4; 18.4; 18.4; 18.4; 18.4; +34 more |
| CVE-2021-0277 | 8.8 | Jul 15 | An Out-of-bounds Read vulnerability in the processing of specially crafted LLDP frames by the Layer 2 Control Protocol Daemon (l2cpd) of Juniper Networks Junos OS and Junos OS… Affected: 12.3; 12.3; 12.3; 12.3; 12.3; 12.3; +34 more |
| CVE-2021-0275 | 8.8 | Apr 22 | A Cross-site Scripting (XSS) vulnerability in J-Web on Juniper Networks Junos OS allows an attacker to target another user's session thereby gaining access to the users session Affected: 12.3; 12.3; 12.3; 12.3; 12.3; 12.3; +34 more |
| CVE-2021-0269 | 8.8 | Apr 22 | The improper handling of client-side parameters in J-Web of Juniper Networks Junos OS allows an attacker to perform a number of different malicious actions against a target device… Affected: 17.4; 17.4; 17.4; 17.4; 17.4; 17.4; +34 more |
| CVE-2021-0208 | 8.8 | Jan 15 | An improper input validation vulnerability in the Routing Protocol Daemon (RPD) service of Juniper Networks Junos OS allows an attacker to send a malformed RSVP packet when… Affected: 15.1x49; 15.1x49; 15.1x49; 15.1x49; 15.1x49; 15.1x49; +34 more |
| CVE-2020-1673 | 8.8 | Oct 16 | Insufficient Cross-Site Scripting (XSS) protection in Juniper Networks J-Web and web based (HTTP/HTTPS) services allows an unauthenticated attacker to hijack the target user's… Affected: 18.1; 18.1; 18.1; 18.1; 18.1; 18.1; +34 more |
| CVE-2020-1656 | 8.8 | Oct 16 | The DHCPv6 Relay-Agent service, part of the Juniper Enhanced jdhcpd daemon shipped with Juniper Networks Junos OS has an Improper Input Validation vulnerability which will result… Affected: 12.3; 12.3; 12.3; 12.3; 12.3; 12.3; +34 more |
| CVE-2020-1609 | 8.8 | Jan 15 | When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay mode it vulnerable… Affected: 15.1; 15.1; 15.1; 15.1; 15.1; 15.1; +34 more |
| CVE-2020-1605 | 8.8 | Jan 15 | When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay mode it vulnerable… Affected: 15.1; 15.1; 15.1; 15.1; 15.1; 15.1; +34 more |
| CVE-2020-1602 | 8.8 | Jan 15 | When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay mode it vulnerable… Affected: 15.1; 15.1; 15.1; 15.1; 15.1; 15.1; +34 more |
| CVE-2019-0070 | 8.8 | Oct 9 | An Improper Input Validation weakness allows a malicious local attacker to elevate their permissions to take control of other portions of the NFX platform they should not be able… Affected: through 18.1; 18.2 |
| CVE-2019-0062 | 8.8 | Oct 9 | A session fixation vulnerability in J-Web on Junos OS may allow an attacker to use social engineering techniques to fix and hijack a J-Web administrators web session and… Affected: 12.3; 12.3; 12.3; 12.3; 12.3; 12.3; +34 more |
| CVE-2019-0047 | 8.8 | Oct 9 | A persistent Cross-Site Scripting (XSS) vulnerability in Junos OS J-Web interface may allow remote unauthenticated attackers to perform administrative actions on the Junos device Affected: 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; +34 more |
| CVE-2018-0045 | 8.8 | Oct 10 | Receipt of a specific Draft-Rosen MVPN control packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execution Affected: 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; +34 more |
| CVE-2018-0043 | 8.8 | Oct 10 | Receipt of a specific MPLS packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execution Affected: 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; +34 more |
| CVE-2018-0021 | 8.8 | Apr 11 | If all 64 digits of the connectivity association name (CKN) key or all 32 digits of the connectivity association key (CAK) key are not configured, all remaining digits will be… Affected: 15.1x49; 15.1x49; 15.1x49; 15.1x49; 15.1x49; 15.1x49; +34 more |
| CVE-2018-0005 | 8.8 | Jan 10 | QFX and EX Series switches configured to drop traffic when the MAC move limit is exceeded will forward traffic instead of dropping traffic Affected: 14.1x53; 14.1x53; 14.1x53; 14.1x53; 14.1x53; 14.1x53; +18 more |
| CVE-2016-1261 | 8.8 | Oct 13 | J-Web does not validate certain input that may lead to cross-site request forgery (CSRF) issues or cause a denial of J-Web service (DoS) Affected: 12.1x44; 12.1x44; 12.1x44; 12.1x44; 12.1x44; 12.1x44; +34 more |
| CVE-2017-2349 | 8.8 | Jul 17 | A command injection vulnerability in the IDP feature of Juniper Networks Junos OS on SRX series devices potentially allows a user with login access to the device to execute shell… Affected: 12.1x44; 12.1x44; 12.1x44; 12.1x44; 12.1x44; 12.1x44; +29 more |
| CVE-2017-2341 | 8.8 | Jul 17 | An insufficient authentication vulnerability on platforms where Junos OS instances are run in a virtualized environment, may allow unprivileged users on the Junos OS instance to… Affected: 14.1x53; 14.1x53-d10; 14.1x53-d15; 14.1x53-d25; 14.1x53-d26; 14.1x53-d27; +34 more |
| CVE-2016-1264 | 8.8 | Apr 15 | Race condition in the Op command in Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R11, 12.3X48 before 12.3X48-D20,… Affected: through 12.1x44; 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; +34 more |
| CVE-2021-0251 | 8.6 | Apr 22 | A NULL Pointer Dereference vulnerability in the Captive Portal Content Delivery (CPCD) services daemon (cpcd) of Juniper Networks Junos OS on MX Series with MS-PIC, MS-SPC3,… Affected: 17.3; 17.3; 17.3; 17.3; 17.3; 17.3; +34 more |
| CVE-2021-0203 | 8.6 | Jan 15 | On Juniper Networks EX and QFX5K Series platforms configured with Redundant Trunk Group (RTG), Storm Control profile applied on the RTG interface might not take affect when it… Affected: 15.1; 15.1; 15.1; 15.1; 15.1; 15.1; +34 more |
| CVE-2020-1632 | 8.6 | Apr 15 | In a certain condition, receipt of a specific BGP UPDATE message might cause Juniper Networks Junos OS and Junos OS Evolved devices to advertise an invalid BGP UPDATE message to… Affected: 16.1; 16.1; 16.1; 16.1; 16.1; 16.1; +34 more |
| CVE-2020-1603 | 8.6 | Jan 15 | Specific IPv6 packets sent by clients processed by the Routing Engine (RE) are improperly handled Affected: 16.1; 16.1; 16.1; 16.1; 16.1; 16.1; +34 more |
| CVE-2019-0041 | 8.6 | Apr 10 | On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0) Affected: 18.2; 18.2 |
| CVE-2016-1286 | 8.6 | Mar 9 | named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature… Affected: 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; +34 more |
The 500 most important CVEs for this product (exploited first, then by severity)