CVE-2026-103994
HighCVSS 8.8Summary
A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS. A malicious or compromised SDN-controller can cause a complete outage of the OVSDB control plane and possibly remote code execution.
Risk Assessment
A malicious SDN controller can paralyze the OVSDB control plane and, in the worst case, achieve remote code execution on the device.
Recommendation
Update Junos OS to a patched version and secure communication with SDN controllers through authentication and network segmentation.
Other vulnerabilities in Junos OS
See all- CVE-2026-33798High
A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series. An L2-adjacent attacker can execute arbitrary code as root via high-availability fabric traffic.
- CVE-2026-33795High
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated network-based attacker can cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised.
- CVE-2026-102185High
A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. A remote network attacker can cause a denial of service via EVPN multihoming with preference-based designated-forwarder election.
- CVE-2026-102184High
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms. A configured EVPN signaling peer can cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update, resulting in a denial of service affecting routing adjacencies.
- CVE-2026-102183High
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. A configured BGP EVPN peer can cause an rpd crash via a specifically malformed NLRI.
- CVE-2026-102180High
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active.
- CVE-2026-102179High
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed.
- CVE-2026-102177High
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.
- CVE-2026-102176High
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled.
- CVE-2026-102174High
A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS identity-publishing path.
Original NVD description (English source)
A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS