Juniper Networks has published fixes for a set of critical vulnerabilities affecting Junos OS and Junos OS Evolved. Its October security bulletin includes several remote code execution paths, as well as denial-of-service and other defects. The bulletin assigns the collection a maximum CVSS v3.1 score of 9.8 and says the issues were found during internal product security testing.
The headline severity does not mean every Juniper device is exposed to every listed attack. Several of the more serious paths depend on a particular platform or enabled service. Administrators need to match the CVE, device role, configuration and running software branch before deciding which systems are most exposed.
Which attack paths stand out?
Juniper lists CVE-2026-102175 as a potential remote code execution or denial-of-service issue when service-deployment processing is used. CVE-2026-101983 concerns remote code execution when a J-Web virtual domain is configured. CVE-2026-33796 could allow remote root command execution when BMP route monitoring is enabled. The same bulletin also describes a remote code execution and denial-of-service path affecting MX and PTX series devices with enhanced CFM enabled, tracked as CVE-2026-102055.
These examples illustrate why a single patch-roundup label can obscure the operational question. An organization with no J-Web virtual domains may have a different exposure to CVE-2026-101983 than one that uses the feature. It still needs to review the full bulletin: other vulnerabilities may apply to its devices and configuration.
Fixed releases and verification
The advisory lists fixed Junos OS releases for each supported branch, including 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2, as well as subsequent releases. Junos OS Evolved has its own fixed-release list. Juniper notes that certain 23.2, 23.4 and 24.2 releases were rebuilt as security respins, so an older copy of a nominally similar release should not be assumed to contain the fix.
Juniper says there is no single workaround for all issues in the bulletin and directs operators to individual CVE records for any issue-specific mitigations. The public reporting reviewed for this article does not establish exploitation in the wild. The immediate task for network teams is to inventory affected devices, compare exact builds and enabled services with the vendor's fixed-release matrix, and schedule updates according to exposure and maintenance constraints.