Juniper security bulletin JSA112187 (October 2026): impact assessment for ISP and data centre networks

On 14 October 2026 Juniper published the combined bulletin JSA112187 covering 109 vulnerabilities in Junos OS and Junos OS Evolved, with an overall „Critical” rating (CVSS up to 9.8). All versions prior to the fixed releases are affected. Actual exposure depends on the configuration: most vulnerabilities occur only when a specific protocol, option or service is enabled. This assessment groups the vulnerabilities by feature and sets the update priority for typical ISP and data centre configurations.

Update priorities

Threat status

• Juniper SIRT is not aware of any exploitation of the vulnerabilities in the bulletin; they were found in internal testing.
• As of 20 October 2026 none of the vulnerabilities is listed in the CISA Known Exploited Vulnerabilities catalogue and no public exploit is available.
• In 2023, after an exploit for the J-Web vulnerabilities (CVE-2023-36844 and others) was published, attack attempts began on the day of publication.

Fixed releases

The software version can be checked with:

show version | match "Junos:"

Points to note:

• Respins. For the 23.2, 23.4 and 24.2 trains Juniper re-released versions that had already been published. The full release number determines the status: 23.4R2-S7.4 is vulnerable, 23.4R2-S8.13 includes the fixes.
• Versions older than 23.2. The bulletin covers all versions prior to 23.2R2-S7.7, while Juniper does not issue fixes for trains past end of support. For 21.x and 22.x a migration to a supported train is required.
• 23.4X100-EVO has no fixed release in this bulletin; a train change is required.

BGP FlowSpec

The most severe group. It concerns routers that accept BGP FlowSpec rules from a DDoS detection system, from an upstream provider or from customers.

Exploitation requires a configured BGP neighbour that sends a crafted rule. When rules originate only from the operator’s own detection system, the risk is limited to a compromise of that system. Accepting FlowSpec from customers (self-service filtering) or from an upstream provider should be treated as critical exposure. Juniper lists no workaround other than disabling FlowSpec.

Verification:

show configuration protocols bgp | display set | match "flow"
show configuration system processes routing | display set | match update-threading
show configuration routing-options bmp

J-Web and management services

On edge routers it is recommended to disable J-Web or restrict it to the management (OOB) network, regardless of the update schedule. SNMP access should be restricted by the lo0 filter to monitoring servers.

Verification:

show configuration system services | display set | match "web-management|service-deployment"
show configuration snmp | display set | match community
show configuration access | display set

eBGP sessions

eBGP sessions with customers and at internet exchanges are established with devices the operator does not manage. The following vulnerabilities allow such a neighbour to crash rpd and, as a result, cause the loss of routing on the device.

CVE-2026-101976 has the widest scope: its only condition is an eBGP session. Virtually every modern router negotiates 4-byte AS support, but a neighbour can disable it deliberately. The vulnerability affects devices with BGP sessions to customers, transit providers and neighbours at internet exchanges.

Verification:

show bgp neighbor | match "Peer:|4 byte"

L2 protocols and IGP on customer-facing interfaces

„Adjacent” vulnerabilities require access to the same L2 segment or a protocol adjacency. In access networks this condition is met by a customer in a subscriber VLAN.

Part of the exposure can be reduced by configuration before the update:

• LLDP only on links to the operator’s own infrastructure instead of interface all;
• customer interfaces in OSPF with the passive option: the subnet remains in the LSDB and the router does not process OSPF packets from that direction;
• BFD with customers only where required.

Verification:

show configuration protocols lldp | display set
show ospf interface
show bfd session

MC-LAG

The bulletin includes six MC-LAG vulnerabilities (ICCP and MAC synchronisation): CVE-2026-102035, -102033, -102034, -101994, -101995 and -101996. The source of attack is an ICCP neighbour, i.e. the other node of the pair, which requires access to the network between the nodes. With ICCP running over a dedicated link or VLAN the risk is low; an update in the next maintenance window is recommended.

MPLS

LDP and RSVP account for over a dozen vulnerabilities, including CVE-2026-101981 (8.8), which allows an LDP neighbour to compromise the Routing Engine. This concerns networks with an MPLS core. With LDP and RSVP enabled only on internal links, an update in the next maintenance window is recommended; when enabled on customer-facing interfaces, the update has high priority (show ldp interface, show rsvp interface).

EVPN, EVPN-VXLAN and SRv6

Over a dozen vulnerabilities concern EVPN, EVPN-VXLAN and SRv6, including CVE-2026-101982 (9.8) with EVPN-VPWS. This is relevant to data centre fabrics and L2VPN services. EVPN neighbours are usually the operator’s own devices; the risk depends on whether an external party can establish a BGP EVPN session. An update in the next maintenance window is recommended.

Features with limited use

The following groups require features rarely used at the edge of ISP and data centre networks. With the feature disabled, the vulnerabilities have no impact:

• BGP-LS and traffic engineering: CVE-2026-101991, -102044, -102022, -102020;
• multicast and MVPN: PIM, MSDP, Auto-RP, Rosen MVPN, inter-AS MVPN, multicast lawful intercept;
• VPLS with automatic site-ID, BGP Prefix-SID on eBGP (accept-prefix-sid), ISO-VPN, extended-nexthop-tunnel, RIB sharding, BGP RIB telemetry;
• provisioning: phone-home and SZTP over DHCP (mainly EX, SRX and QFX), DHCPv4 local-client, 802.1X and Unified Access Policy;
• RIP, IS-IS with Flex-Algo or backup selection, GMPLS.

Two local vulnerabilities (CVE-2026-101927 and -101934 in eventd) require an account on the device and are relevant where accounts are granted to people outside the network team.

Recommendations

• Update to the fixed release within the current train, as per the table above.
• High priority for devices with BGP FlowSpec, eBGP sessions with external parties, and J-Web or SNMP reachable from the network.
• Independently of the update: J-Web disabled, SNMP restricted by the lo0 filter, LLDP limited to infrastructure links, customer interfaces in OSPF set to passive.

ITORO deploys and operates Juniper MX filtering gateways with BGP FlowSpec; the review covered the installations operated by ITORO first.

Source: Juniper JSA112187, 2026-10 Security Bulletin: Junos OS and Junos OS Evolved and the individual CVE records.