CVE-2026-101982 and CVE-2026-101990: Two Route-Advertisement Bugs That End in Root on Junos

Most of the October 2026 Junos advisories need a reachable management interface. These two do not. CVE-2026-101982 and CVE-2026-101990 live in the routing protocol daemon, and they are triggered by route advertisements rather than by HTTP requests, which means the attacker's entry point is a BGP session rather than a web console.

Vulnerability overview

CVE-2026-101990 is a stack-based buffer overflow in the routing protocol daemon of Junos OS and Junos OS Evolved. NVD states that a remote configured BGP peer can cause an rpd crash, or remote code execution on Junos OS, by sending a flow-spec update that is selected for re-advertisement.

CVE-2026-101982 is also a stack-based buffer overflow in rpd.…