Skip to content

Juniper Junos coordinated review dump (100+ GHSAs): semi-trusted protocol peers, impersonated helper servers, and a read-only SNMP credential that reaches root

Wave in one line: Juniper shipped a Cisco-style coordinated security-review dump — more than 100 advisories in a single 18:32Z window, dominated by Junos OS / Junos OS Evolved per-daemon memory corruption — and the interesting part for an authorized engagement is not the count but the trust inventory it publishes: configured BGP/EVPN/BMP peers, HTTPS feed servers, SDX deployment servers, DHCP servers, GRE tunnels, SNMP read communities, and the J-Web management plane all have root-RCE legs attached.

Signal: GitHub Security Advisories published the Junos wave at 2026-10-14T18:32Z (anchor advisory GHSA-34c5-5qc5-99pf / CVE-2026-101954, JSA112187); the published feed carries 100+ advisories in this window with the same Junos daemon tail repeating past the API pagination ceiling. As with the NGINX (Oct 14 15:3xZ) and Cisco (Oct 7) review dumps, GHSA package version fields are empty — fix bands live only in the vendor JSA, so product/version fingerprinting comes from the device itself (show version, show configuration | display set for feature gates), not from the advisory. None of these CVEs were in CISA KEV at catalog 2026.10.13 at scan time.

Notable legs (the reachable-boundary ones, not the crash-of-the-week tail)

GHSA CVE CVSS Boundary
GHSA-34c5-5qc5-99pf CVE-2026-101954 9.8 J-Web + NETCONF session handling: unauthenticated network attacker → root-level configuration access and full device takeover whenever web management is enabled.
GHSA-wg6r-2r3p-3vc7 CVE-2026-101983 9.8 httpd (J-Web): unauthenticated network attacker → RCE/DoS via a J-Web virtual-domain configuration path.
GHSA-pvg7-92rm-23q6 CVE-2026-102182 9.8 kmd (MX Series): unauthenticated attacker → root code execution via IKE certificate-based packets (all versions before 21.2R3-S11 band given in the advisory).
GHSA-vq3c-j5rc-g6c5 CVE-2026-101982 9.8 rpd: a configured BGP/EVPN peer → root code execution on Junos OS (rpd crash on Evolved) via protocol-valid route advertisements for an EVPN-VPWS service.
GHSA-6wm5-v698-ppc6 CVE-2026-33789 9.8 rpd: unauthenticated BGP peer → DoS and potential root command execution via crafted BGP route updates when BMP (BGP Monitoring Protocol) is enabled.
GHSA-fcqq-h8rj-r9h8 CVE-2026-33796 9.8 rpd: configured external BGP neighbor → root command execution via BMP route monitoring.
GHSA-42m5-pcqx-g75h CVE-2026-102178 9.8 BGP daemon: configured flowspec peer → routing-engine compromise or rpd DoS via flowspec route re-advertisement when BGP update-threading is enabled.
GHSA-8g7f-8jqh-v9wr CVE-2026-33792 9.8 srxpfe (SRX): unauthenticated attacker → root code execution via a crafted packet on a configured GRE tunnel (tunnel decapsulation before policy).
GHSA-cgph-8w37-fcq2 CVE-2026-101979 8.8 authd: a network attacker with SNMP read access → root code execution via a specific SNMP packet when SNMP + AAA are enabled.
GHSA-w9fm-9w6m-778h CVE-2026-102059 8.8 phcd phone-home daemon (EX/SRX/QFX): adjacent unauthenticated attacker via a rogue DHCP server → arbitrary command execution as root.
GHSA-82mq-p57x-wwx4 CVE-2026-102055 8.1 ipfd (SRX): compromised or impersonated configured HTTPS feed server → root code execution via format string.
GHSA-xvcv-xqx7-5wqh CVE-2026-102175 9.8 sdxd: attacker who can control or intercept the SDX/SRC service-deployment TCP connection → root code execution via a crafted frame.
GHSA-fmx5-gpxg-52jp CVE-2026-102174 8.8 iked (SRX): an authenticated remote-access VPN client → root code execution via the remote-access VPN auth + JIMS identity-publishing path.
GHSA-hm6p-fvm3-957g CVE-2026-103994 8.8 vgd VXLAN Gateway Daemon: malicious/compromised SDN controller → OVSDB control-plane outage and possible RCE.
GHSA-fwgj-cw99-g2wp CVE-2026-102084 8.1 VPN daemon ADVPN (SRX): malformed peer attributes with a acquired/reused shared secret → buffer overflow → complete device control.

Durable operator axes

  1. The review dump IS the trust-surface map. The advisory set names its owning daemon (rpd, srxpfe, httpd, kmd, authd, phcd, ipfd, sdxd, vgd, iked, l2cpd, l2ald, jdhcpd, cfmd, bfdd, clksyncd, TWAMP client, PFE). That list is an engagement checklist: each named process is a separately fingerprintable listener or outbound channel. Same review-dump rule as the Oct 7 Cisco NGOAM page — pivot empty GHSA version fields to the vendor JSA (here JSA112187), and fingerprint the device, not the advisory.
  2. Protocol peers are semi-trusted principals with root reach. Three 9.8 legs are triggered by configured BGP-class peers (EVPN-VPWS advertisements, BMP route monitoring, flowspec re-advertisement). On authorized assessments of service-provider/enterprise backbones, an established eBGP session from any transited AS is a remote-code path, and feature gates are the fingerprint: BMP enabled (show configuration protocols bmp), update-threading, EVPN-VPWS instances — check the config for feature enablement before ranking which legs are live, exactly like the NGINX config-shape rule the same day. "protocol-valid route advertisements" in the advisory text means the input passes the protocol state machine before hitting the overflow — fuzzing at the schema-valid boundary, not the malformed-packet boundary, is where these live.
  3. Helper-server return channels are unauthenticated parsers. ipfd (HTTPS feed server), sdxd (SDX/SRC deployment TCP), phcd (DHCP) are all outbound-initiated relationships whose responses parse attacker data as root or root-adjacent. Impersonating a configured feed/deployment/DHCP server — via DNS takeover, stale feed URL, or adjacent-network rogue DHCP — yields root RCE without ever touching the management plane. Sweep rule for any network appliance: enumerate every configured outbound fetch (services, feed URLs, auto-deploy, phone-home, NTP/DNS/DHCP dependencies) and treat each as an unauthenticated inbound listener at root privilege; test feed transport authenticity with lab-controlled impersonation only.
  4. Read-only credentials that cross into execution. authd: an SNMP read community + AAA enabled = root code execution via one packet. A monitoring-only credential is an RCE prerequisite — inventory SNMP read strings, TACACS/RADIUS shared secrets, and monitoring-plane accounts as attack-path material, not just "info-level" findings. Same containment-by-privilege-tier theme as the Brocade SAN waves.
  5. J-Web is the standard forgotten perimeter. The anchor 9.8 (unauthenticated J-Web/NETCONF → root config access) plus the httpd 9.8 make "is J-Web exposed, and on which interface" a first-class recon question on any Juniper in scope, with the virtual-domain//webui route family as the alternate-surface sweep. Post-auth legs (iked VPN-client → root, authenticated network attacker PAN-OS-style management RCEs) confirm: on these appliances, post-auth ≠ low impact — every authenticated surface is a root candidate.
  6. Same-wave perimeter context, tracked: a 9.8 in the same window — GHSA-6rc3-jwq8-jm3v / CVE-2026-76519, Cisco Secure Email Gateway AMP file-reputation feature: unauthenticated crafted email attachment → arbitrary file write → root on the underlying OS. The security-inspection engine is itself the pre-auth parser and mail flow is a free, unfiltered input channel to it — when any mail-security appliance is in scope, the inspection feature (not the admin UI) is the primary surface. Kept as a tracked note here (single leg, no new axis) rather than its own page.

Validation boundaries

  • Route-advertisement, IKE, GRE, SNMP, and DHCP legs go only on lab or customer-expressly-approved gear; most legs crash or own the routing engine — a worker-crash-equivalent here is an outage. Config-feature inventory (show configuration protocols, SNMP/AAA state, feed URLs, J-Web exposure via show configuration services) is passive and safe; exploitation is not, absent explicit approval.
  • Feed/DHCP/SDX impersonation proofs stay in lab VLANs with synthetic servers and marker canaries; never intercept a live feed or deployment channel in production.

Tracked in this window, no publish

  • Junos remainder: rpd/l2cpd/jdhcpd/cfmd/bfdd/ikmd/clksyncd/TWAMP overflow + assertion + NULL-deref tail (DoS-labeled memory-safety per parser precedent; revisit any leg that pairs with a read primitive), na-grpcd highly-compressed gRPC DoS (734c), format-string ipfd sibling, SDK/sdxd backfills.
  • GHSA-9fh3-97mp-7wmv / CVE-2026-0322, PAN-OS management-interface authenticated → root RCE: detail-free, vendor defers to management-access best practice; revisit when a band/leg detail lands.
  • GHSA-fqwq-55mh-xc85 / CVE-2026-93635 + GHSA-gm33-c835-gc8h / CVE-2026-93637: Zimbra unauthenticated LDAP filter injection → password oracle under search-filter auth + lazy provisioning, plus auth rate-limit bypass — filter-injection and limiter-keying classes already covered; the password-oracle combo is worth re-checking only if a concrete workflow detail lands.
  • GHSA-hj5g-wfrp-6x6g / CVE-2026-110097 Ikaros TOTP skip by presenting the jwt/apply login temp token as a bearer JWT — presence-of-token-is-not-purpose-binding family, already promoted on the Sept 17 Craft preview-token page; tracked.
  • DPDK vhost/vhost-crypto octet (CVE-2026-86845–86849, 86562–86567): guest-to-host descriptor/TOCTOU/stale-session memory safety — guest-controlled-vring class per parser precedent; revisit if a leg demonstrates host escape beyond crash.
  • SharePoint missing-authorization elevation (f79v), Lantronix XPress-DR missing auth (gpg6, thin), ServiceNext /api/Usuario/GetUsuarios IDOR (5323), ADP Desktop SDK cleartext (x9hc), thin WP XSS/code-injection singles (Salevo, MDTF, Skydropx) — sparse/vuldb-class, known taxonomies.

Cross-references