[NEW] [high] Juniper JUNOS and JUNOS Evolved: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Juniper JUNOS, JUNOS Evolved, Juniper EX Series, Juniper MX Series, Juniper QFX Series, and Juniper SRX Series to cause a Denial of Service condition, disclose information, execute code, and trigger undefined behavior.
CSIRTS triage
- What
- Multiple vulnerabilities can be exploited to cause Denial of Service, disclose information, and execute code.
- Who is affected
- Users of Juniper JUNOS, JUNOS Evolved, and related series are affected.
- Urgency
- Remediation is urgent due to the high severity and potential for exploitation.
- Action
- Update to the latest version of JUNOS.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch JUNOS
Get an email when a new JUNOS advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2257
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-219010.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.
- Low exploitation riskCVE-2026-570250.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all scored CVEs.
- Low exploitation riskCVE-2026-337990.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all scored CVEs.
- Low exploitation riskCVE-2026-338010.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.
- Low exploitation riskCVE-2026-338030.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all scored CVEs.
- Low exploitation riskCVE-2026-570280.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all scored CVEs.
- Low exploitation riskCVE-2026-337940.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
- Low exploitation riskCVE-2026-570290.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all scored CVEs.
- Moderate exploitation riskCVE-2020-74502.5% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 83% of all scored CVEs.
- Low exploitation riskCVE-2026-570270.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- mediumCVE-2026-57054: A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of J…nvd
- mediumCVE-2026-57032: An Improper Handling of Undefined Parameters vulnerability in the packet forwarding engine (pf…nvd
- mediumCVE-2026-57031: An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding…nvd
- mediumCVE-2026-57030: A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') …nvd
- mediumCVE-2026-57029: A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Juno…nvd
- highCVE-2026-57028: An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Junipe…nvd
- mediumCVE-2026-57027: A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding en…nvd
- highCVE-2026-57026: An Improper Validation of Syntactic Correctness of Input vulnerability in the SIP plugin of Ju…nvd
- mediumCVE-2026-57025: A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Jun…nvd
- mediumCVE-2026-57024: A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) o…nvd
- highCVE-2026-57023: An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of…nvd
- mediumCVE-2026-57022: An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding…nvd
Recent advisories for Juniper JUNOS and
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCVE-2026-57054: A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of J…nvd · 2026-07-09
- mediumCVE-2026-57032: An Improper Handling of Undefined Parameters vulnerability in the packet forwarding engine (pf…nvd · 2026-07-09
- mediumCVE-2026-57031: An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding…nvd · 2026-07-09
- mediumCVE-2026-57030: A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') …nvd · 2026-07-09
- mediumCVE-2026-57029: A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Juno…nvd · 2026-07-09
- highCVE-2026-57028: An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Junipe…nvd · 2026-07-09
More from CERT-Bund (BSI) Security Advisories
- medium[NEW] [medium] DENX U-Boot: Multiple vulnerabilities allow execution of arbitrary code and DoS2026-07-10
- medium[NEW] [medium] Samsung Android: Multiple vulnerabilities2026-07-10
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-10
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow unspecified attack2026-07-10
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-10