JUNIPER Networks released October 2026 security bulletins addressing a broad set of critical vulnerabilities in Junos OS and Junos OS Evolved across MX, SRX, PTX, EX, and QFX platforms. The combined advisories cover more than 60 routing and management bugs across core OS and J-Web components, BGP/rpd and BMP routing paths, and platform-specific branches.
Ten CVEs are highlighted as Critical (CVSS v3.1 scores up to 9.8), with several enabling unauthenticated remote code execution or full device takeover, depending on the feature set enabled or the hardware family. Notably, CVE-2026-102182 (MX Series) permits root-level code execution via certificate-based IKE packets, and CVE-2026-101954 (J-Web-enabled systems) allows unauthenticated network access leading to full device takeover. Other high-risk flaws include CVE-2026-101986 (pre-auth CGI execution in J-Web) and CVE-2026-33792 (remote code execution with GRE tunnels on SRX).
Juniper states there are no known workarounds for these issues and urges immediate remediation through upgraded software releases. Affected versions span Junos OS and Junos OS Evolved across multiple branches prior to the latest maintenance releases; admins should upgrade to specified fixed lines such as 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2, 26.2R2, 26.4R1, and their Evolved equivalents (e.g., 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, up to 26.4R1-EVO).
The advisories note no active exploitation in the wild has been confirmed at the time of publication, though administrators should treat these as high-priority incidents requiring rapid patching to protect routing and firewall infrastructure globally.