CVE-2026-101940

A Use After Free vulnerability was identified in the 802.1X authentication daemon (dot1xd) of Juniper Networks Junos OS and Junos OS Evolved. An authenticated, network-adjacent attacker can flap a port to crash the dot1xd process, leading to a Denial of Service (DoS), or potentially execute arbitrary code as root. The issue occurs during processing of a change of authorization (CoA) when a port bounce happens, where a freed pointer is later referenced.

A vulnerability in the packet forwarding engine (PFE) of Junos OS on SRX Series allows an unauthenticated network-based attacker to send a specific ICMP packet through a GRE tunnel, causing the PFE to crash and restart. The issue occurs when PowerMode IPsec (PMI) and GRE performance acceleration are enabled, leading to traffic loss.

Junos OS versions before 12.1X46-D50 on SRX Series devices revert to 'safe mode' after a failed upgrade to 12.1X46, allowing root CLI logins without a password. This may allow local users to gain privileges by leveraging the 'request system software' command with the 'partition' option.

In Juniper Junos OS versions before 12.1X46-D45, 12.1X47-D30, 12.3R11, 12.3X48-D25, 13.2R8, 13.3R7, 14.1R6, 14.2R4, 15.1R1, 15.1F2, and 15.1X49-D15, a vulnerability allows local users to gain privileges via crafted combinations of CLI commands and arguments. This is a different vulnerability than CVE-2015-3003, CVE-2014-3816, and CVE-2014-0615.

A race condition in the Op command in Juniper Junos OS allows remote authenticated users to gain privileges via the URL option. This affects versions before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, and other listed versions.

In Juniper Junos OS versions before 11.4R12-S4, 12.1X44-D41, 12.1X46-D26, 12.1X47-D11/D15, 12.2R9, 12.2X50-D70, 12.3R8, 12.3X48-D10, 12.3X50-D42, 13.1R4-S3, 13.1X49-D42, 13.1X50-D30, 13.2R6, 13.2X51-D26, 13.2X52-D15, 13.3R3-S3, 14.1R3, 14.2R1, 15.1R1, and 15.1X49-D10, when configured for IPv6, remote attackers can cause a denial of service (mbuf chain corruption and kernel panic) via crafted IPv6 packets.

A vulnerability in Juniper Junos OS allows remote attackers to cause a denial of service by sending a large number of BGP-VPLS advertisements with updated BGP local preference values. This affects multiple versions of the OS before their respective patches.

A vulnerability in Juniper Junos OS allows remote attackers to cause a denial of service by sending a large number of requests, triggering a TCP connection to move to the LAST_ACK state while there is more data to send.

In Juniper Junos OS versions from 9.1 to 14.1 before specific updates, a vulnerability exists that allows remote attackers to cause a denial of service through crafted transitive attributes in a BGP UPDATE. This can lead to memory corruption and a crash and restart of the RDP routing process.