CVE-2026-21919
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
An Incorrect Synchronization vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker with low privileges to cause a complete Denial-of-Service of the management plane. Rapidly establishing and disconnecting NETCONF sessions triggers a locking issue that causes mgd processes to hang in an unusable state, and once the maximum number of mgd processes is reached, no new logins are possible.
Risk Assessment
The organization loses the ability to manage the device, requiring a power-cycle to recover. A low-privileged attacker can thus persistently block administration of the network device.
Recommendation
Upgrade Junos OS to 23.4R2-S4, 24.2R2-S1, or 24.4R1-S3/24.4R2 (Junos OS Evolved to 23.4R2-S5-EVO, 24.2R2-S1-EVO, or 24.4R1-S3-EVO/24.4R2-EVO respectively). Monitor for mgd processes in lockf state and terminate them with 'request system process terminate <PID>' or 'kill -9 <PID>' if needed.
Other vulnerabilities in Junos OS
See all- CVE-2026-21917High
A vulnerability in the Web-Filtering module of Junos OS on SRX Series allows an unauthenticated network-based attacker to cause a Denial-of-Service (DoS). A specially crafted SSL packet causes an FPC crash and restart.
- CVE-2026-21913High
A vulnerability in Juniper Junos OS on EX4000 models with 48 ports (EX4000-48T, EX4000-48P, EX4000-48MP) allows an unauthenticated network-based attacker to cause an FXPC crash and restart by sending a high volume of traffic to the device. This leads to a complete service outage until the device automatically restarts.
- CVE-2026-21905High
A vulnerability in Junos OS on SRX and MX devices with MX-SPC3 or MS-MPC service cards causes an infinite loop in the flow management process (flowd or mspmand) after receiving specific SIP messages over TCP. An unauthenticated attacker can send multiple such messages, leading to watchdog timer expiration and process crash, resulting in a Denial of Service (DoS). The issue only occurs over TCP, not UDP.
- CVE-2025-60003High
A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When an affected device receives a BGP update with a set of specific optional transitive attributes over an established peering session, rpd will crash and restart when attempting to advertise the received information to another peer.
- CVE-2025-59960High
A vulnerability in the DHCP service (jdhcpd) of Junos OS and Junos OS Evolved allows a DHCP client in one subnet to exhaust the address pools of other subnets, leading to a Denial of Service (DoS) on the downstream DHCP server. The issue arises from improper handling of DHCP DISCOVER packets with Option 82 in 'forward-only' mode, which are forwarded unmodified instead of being dropped, consuming addresses from the pool.
- CVE-2016-4922High
A vulnerability in Junos OS allows unauthorized access to the operating system through certain combinations of CLI commands. Users with the appropriate permissions can achieve elevated privileges and gain complete control of the device.
- CVE-2017-2344High
An internal Junos OS sockets library is vulnerable to a buffer overflow, which may lead to a denial of service (kernel panic) or privilege escalation through local code execution. The routines are only accessible via programs running on the device.
- CVE-2017-2303High
On Juniper Networks products or platforms running Junos OS versions prior to 12.1X46-D50, 12.1X47-D40, 12.3R13, 12.3X48-D30, 13.2X51-D40, 13.3R10, 14.1R8, 14.1X53-D35, 14.1X55-D35, 14.2R5, 15.1F6, 15.1R3, 15.1X49-D30, 15.1X49-D40, 15.1X53-D35, where RIP is enabled, certain RIP advertisements may cause the RPD daemon to crash, resulting in a denial of service condition.
- CVE-2017-2302High
On Juniper Networks products running Junos OS versions prior to 12.1X46-D55, 12.1X47-D45, 12.3R13, 12.3X48-D35, 13.3R10, 14.1R8, 14.1X53-D40, 14.1X55-D35, 14.2R6, 15.1F2 or 15.1R1, where the BGP add-path feature is enabled with 'send' option or with both 'send' and 'receive' options, a network-based attacker can cause the rpd daemon to crash and restart. Repeated crashes of the rpd daemon can result in an extended denial of service condition.
- CVE-2017-2301High
On Juniper Networks products running Junos OS versions prior to 11.4R13-S3, 12.1X46-D60, 12.3R12-S2, 13.2X51-D40, 13.3R10, 14.1R8, 14.1X53-D12, 14.1X55-D35, 14.2R7, 15.1F6, 15.1R3, 15.1X49-D60, and 15.1X53-D30, when DHCPv6 is enabled, receiving a crafted DHCPv6 packet causes the jdhcpd daemon to crash and restart. Repeated crashes of the jdhcpd process may lead to an extended denial of service condition for subscribers attempting to obtain IPv6 addresses.
Original NVD description (English source)
An Incorrect Synchronization vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker with low privileges to cause a complete Denial-of-Service (DoS) of the management plane. When NETCONF sessions are quickly established and disconnected, a locking issue causes mgd processes to hang in an unusable state. When the maximum number of mgd processes has been reached, no new logins are possible. This leads to the inability to manage the device and requires a power-cycle to recover. This issue can be monitored by checking for mgd processes in lockf state in the output of 'show system processes extensive': user@host> show system processes extensive | match mgd <pid> root 20 0 501M 4640K lockf 1 0:01 0.00% mgd If the system still can be accessed (either via the CLI or as root, which might still be possible as last resort as this won't invoke mgd), mgd processes in this state can be killed with 'request system process terminate <PID>' from the CLI or with 'kill -9 <PID>' from the shell. This issue affects: Junos OS: * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2-S1, * 24.4 versions before 24.4R1-S3, 24.4R2; This issue does not affect Junos OS versions before 23.4R1; Junos OS Evolved: * 23.4 versions before 23.4R2-S5-EVO, * 24.2 versions before 24.2R2-S1-EVO, * 24.4 versions before 24.4R1-S3-EVO, 24.4R2-EVO. This issue does not affect Junos OS Evolved versions before 23.4R1-EVO;
Vulnerability data from NVD (NIST) · CISA KEV · EPSS