Juniper patches multiple Junos OS vulnerabilities
ANSSI advisory details numerous vulnerabilities across Juniper Junos OS, Junos OS Evolved, cRPD, CTPView, Junos Space and Network Director, mostly enabling denial of service.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 23 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR published an advisory summarizing a large batch of vulnerabilities patched by Juniper Networks across its Junos OS, Junos OS Evolved, cRPD, CTPView, Junos Space, and Network Director product lines. The flaws, disclosed via Juniper's July 2026 security bulletins, affect numerous version branches and platform series (MX, SRX, EX, QFX, PTX) and can lead to remote denial of service through process crashes (rpd, flowd, l2ald, iked, fxpc, evo-pfemand), memory leaks, FPC/PFE resets, and in some cases arbitrary code execution or confidentiality breaches. Root causes span malformed BGP/SNMPv3/TCP/SIP packet handling, VPN negotiation failures, SSH configuration issues, and improperly exposed ports.
The advisory lists over 20 CVEs, including a re-flagged legacy libfetch heap-buffer-overflow issue (CVE-2020-7450) affecting Junos OS Evolved. No evidence of active exploitation is indicated in the source; this is a routine vendor patch cycle affecting network infrastructure devices widely used by enterprises and service providers. Affected organizations should prioritize patching based on exposed services (SNMP, VPN, web filtering) and platform criticality, referring to Juniper's individual security bulletins for version-specific fixes.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0852
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs