Key points
- CVE-2026-101980 affects Junos OS versions prior to specific R2 service releases across 23.2, 23.4, 24.2 and 24.4 branches.
- The vulnerability allows remote, unauthenticated network-based attackers to trigger a denial of service via a kernel crash.
- National Vulnerability Database rates the issue as critical with a CVSS score of 9.8 or 9.3 depending on the record entry.
Juniper Networks Junos OS devices running versions older than 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5 or 24.4R2-S5 are affected by this flaw. These specific release lines remain vulnerable until updated to the listed service releases or newer. The vendor has not confirmed a patch for versions outside these specific branch cutoffs in the provided data, leaving some deployments potentially exposed without a confirmed fix path.
In plain English
The kernel in these Junos OS versions contains an integer underflow error. This type of flaw occurs when a program calculates a number that drops below the minimum value it can handle. When Extended Echo is configured on the device, this calculation error allows an attacker to crash the system. The result is a denial of service because the kernel stops functioning.
The background
The National Vulnerability Database lists CVE-2026-101980 with a CVSS score of 9.8, classifying it as critical. Another entry shows a score of 9.3. Both records cite CWE-191, the standard identifier for integer underflow weaknesses. The vulnerability requires no authentication and can be exploited over the network. This means an attacker does not need credentials to trigger the crash.
What changes now
Teams must determine if their routers or switches have Extended Echo enabled. This feature is often used for network monitoring but creates the condition for this specific attack. If the feature is active and the device runs an affected version, the system is at risk. Administrators should prioritize checking configurations on internet-facing equipment first, as these are most accessible to external attackers.
Who needs to act first
Security operations teams should immediately identify systems with Extended Echo enabled. These devices represent the highest exposure because the vulnerability requires this specific configuration to be exploited. Teams usually prioritize internet-facing infrastructure first, as remote attackers can reach these targets without physical access. Before rolling out any changes, verify backup configurations exist. Testing updates in a non-production environment helps ensure stability. If a fix is not yet available for your version, consider disabling Extended Echo temporarily to reduce the attack surface while waiting for vendor guidance.
What to do and how to stay safe: Juniper Networks
- Audit all Junos OS devices to identify which ones have Extended Echo enabled.
- Check current firmware versions against the affected lists provided by the vendor.
- Verify if a supported service release exists for your device branch and plan an update window.
- Monitor network logs for unusual traffic patterns that could indicate exploitation attempts.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Juniper products are affected by CVE-2026-101980?
Juniper Networks Junos OS versions before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5 and 24.4R2-S5 are affected.
Is authentication required to exploit this vulnerability?
No, the source material states that an unauthenticated, network-based attacker can exploit the flaw.
What is the severity rating for this CVE?
The NVD records list the CVSS score as 9.8 and 9.3, both classified as critical.
