CVE-2026-57027: A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series devices allows an unauth

mediumCVSS 6.5CVE-2026-57027

A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series devices allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS).When sFlow is configured in a Virtual Chassis (VC) scenario with EX4100 Series or EX4400 Series devices, multicast traffic which is received on one VC member and sent out on another member leads to a memory leak and ultimately an FPC crash and restart. The leak can be monitored by watching the continuous increase of the buffer values in the output of: user@host> show chassis fpc This issue affects Junos OS on EX4100 Series and EX4400: - all versions before 23.2R2-S7, - 23.4 versions before 23.4R2-S7, - 24.2 versions before 24.2R2-S4, - 24.4 versions before 24.4R2.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 6.5
Published: 2026-07-09
Last updated: 2026-07-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-57027

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-570270.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-57027	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] Juniper JUNOS and JUNOS Evolved: Multiple vulnerabilitiescert-bund
unknownJuniper Junos OS Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in Juniper Networks products (July 09, 2026)cert-fr-avis

Recent advisories for A Missing Release

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-10699: Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (…nvd · 2026-07-08
unknownCVE-2026-53429: Missing Release of Memory after Effective Lifetime vulnerability in leandrocp mdex and mdex_na…nvd · 2026-06-29