Juniper Junos BGP Flowspec Flaw Rated Critical, Enables Remote Compromise

A critical vulnerability in Juniper Networks’ routing software allows attackers to compromise routing engines or trigger a denial of service. The flaw, tracked as CVE-2026-102178, exists in the Border Gateway Protocol (BGP) routing daemon of both Junos OS and Junos OS Evolved platforms, according to National Vulnerability Database records.

The security issue is a stack-based buffer overflow, classified under CWE-121. According to the NVD, the vulnerability enables a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service. This occurs specifically when flowspec route re-advertisement happens while BGP update-threading is enabled on the device.

The severity of the flaw is rated as Critical by the NVD. Two separate records for CVE-2026-102178 list CVSS scores of 9.8 and 9.3, respectively. Both entries identify the weakness as a stack-based buffer overflow in the BGP routing daemon, confirming the high potential for significant system disruption or unauthorized access.

Context and Background

The vulnerability resides in how the BGP routing daemon handles specific traffic conditions. According to the source material, the exploit requires the presence of a configured BGP flowspec peer. This peer can trigger the buffer overflow via flowspec route re-advertisement.

Crucially, the exploitation path depends on a specific configuration setting. The NVD records state that the vulnerability is exploitable when BGP update-threading is enabled. This feature, which manages how BGP updates are processed, appears to be the vector that allows the malformed data to crash the daemon or compromise the engine.

Who Is Affected

Multiple versions of Juniper’s operating systems are vulnerable to this flaw. According to the NVD, affected versions of Junos OS include those before 23.2R2-S7.7, before 23.4R2-S8.13, before 24.2R2-S5.5, and before 24.4R2-S5.

Junos OS Evolved users are also at risk. The affected versions for this platform include those before 23.2R2-S7.7-EVO, before 23.4R2-S8.11-EVO, before 24.2R2-S5.6-EVO, and before 24.4R2-S5-EVO. Organizations running any of these earlier releases should verify their current version against this list.

What should you do?

Administrators should immediately audit their Juniper devices to determine if they are running vulnerable versions of Junos OS or Junos OS Evolved. Checking the specific maintenance release level is essential, as minor version differences determine exposure.

If BGP update-threading is enabled on the network, the risk of exploitation is present. Users should review their BGP configurations to see if flowspec peers are configured, as this is a prerequisite for the attack vector described in the NVD records.