CVE-2026-101950 and 6 Critical Junos OS CVEs: Juniper SRX Heap Overflow Detection and Remediation Guide

Introduction

In the last 72 hours, NVD published seven CRITICAL, network-vector CVEs affecting Juniper Networks Junos OS, three of them scoring a maximum-severity CVSS 9.8. The headline flaw, CVE-2026-101950, is a heap-based buffer overflow in the Secure Vector Routing (SVR) component on SRX Series firewalls that an unauthenticated, remote attacker can trigger simply by sending malformed IPv4 packets to an SVR-enabled interface. Successful exploitation causes denial of service and — per the advisory language — potentially compromises confidentiality and integrity, which on a perimeter firewall is about as bad as it gets.

Two additional 9.8s compound the risk: CVE-2026-101990, a stack-based buffer overflow in the routing protocol daemon (rpd), and CVE-2026-102031, an OS command injection in the TACACS implementation. The remaining four — CVE-2026-101954, CVE-2026-101982, CVE-2026-102175, and CVE-2026-102178 — round out a batch that should force every organization running Junos OS in a routing or firewall role into an emergency change window.

If your SRX clusters terminate internet-facing SVR/SD-WAN tunnels, treat this as a perimeter emergency: your edge device is the target, no credentials are required, and the attack surface is the data plane itself.

Technical Analysis

Affected Products and Components

How the Vulnerabilities Work

CVE-2026-101950 (SVR heap overflow). The flaw lives in the packet-handling path for Secure Vector Routing on SRX Series platforms. An attacker sends crafted IPv4 packets to an interface with SVR configured. Because parsing happens before any authentication, no session, credentials, or user interaction is required — this is a classic pre-auth memory corruption in a data-plane-adjacent daemon. The immediate, reliable outcome is a crash (DoS of the forwarding/security services); the heap-overflow class and the advisory's confidentiality/integrity language mean code execution is a realistic concern once exploit research matures.

CVE-2026-101990 (rpd stack overflow). rpd is the heart of Junos routing — it handles BGP, OSPF, IS-IS, and related protocols. A stack-based buffer overflow here, reachable from the network, means a malformed routing-protocol message could crash rpd (tearing down all routing adjacencies — a network-wide outage) or, in the worst case, achieve control-flow hijack on the routing engine. If you peer BGP with untrusted or semi-trusted parties (peering exchanges, customers, upstreams), your rpd attack surface is larger than you think.

CVE-2026-102031 (TACACS OS command injection). Command injection in the TACACS component means input handled during authentication/authorization flows can escape into shell execution on the device. Depending on implementation specifics, this could be reachable during login processing — turning your AAA infrastructure into a foothold on the network device itself, with the attacker's commands running in the Junos shell context.

Exploitation Status

As of publication, these CVEs are newly published (last 3 days) with no confirmed in-the-wild exploitation and no CISA KEV listing yet. That is a temporary comfort, not a durable one. Juniper edge vulnerabilities have historically been weaponized within days-to-weeks of disclosure, and unauthenticated network-exploitable 9.8s on perimeter firewalls are exactly what botnet operators and initial-access brokers prioritize. The pre-KEV window is your opportunity — patch before the PoCs land, because they will.

Detection & Response

Detection on network appliances is different from endpoint work: you won't get EDR telemetry from an SRX. Your sensors are Junos syslog (forwarded to your SIEM), crash artifacts, AAA accounting logs, and flow data. The rules below target the observable behaviors of these three named flaws — daemon crashes, unexpected core dumps, rpd churn, and shell execution tied to TACACS sessions.

SIGMA Rules

---
title: Junos SVR Daemon Crash or Core Dump - Possible CVE-2026-101950 Exploitation
id: 3f8a1c94-2b6d-4e57-9a01-7c4d5e6f8a9b
status: experimental
description: Detects crash events, core dumps, or repeated restarts of the SVR component on Juniper SRX devices, consistent with heap overflow exploitation via malformed IPv4 packets.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101950
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1499
logsource:
  product: juniper
  service: syslog
detection:
  selection_svr:
    Message|contains:
      - 'svr'
  selection_crash:
    Message|contains:
      - 'core dump'
      - 'segfault'
      - 'signal 11'
      - 'SIGSEGV'
      - 'process exited'
      - 'kernel crash'
      - 'panic'
  condition: selection_svr and selection_crash
falsepositives:
  - Software defects during legitimate upgrades
level: high
---
title: Junos rpd Crash or Repeated Restart - Possible CVE-2026-101990 Exploitation
id: 8b2e5d17-4c9a-4f36-b812-6d3a7e9c1f45
status: experimental
description: Detects rpd crashes, fatal signals, or rapid repeated restarts on Junos devices, consistent with stack overflow exploitation of the routing protocol daemon.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101990
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1499
logsource:
  product: juniper
  service: syslog
detection:
  selection:
    Message|contains:
      - 'rpd'
  selection_event:
    Message|contains:
      - 'core dump'
      - 'sigsegv'
      - 'sigbus'
      - 'sigabort'
      - 'fatal'
      - 'terminated'
      - 'RPD_EXIT'
      - 'RPD_FATAL'
  condition: selection and selection_event
falsepositives:
  - Known rpd instability on heavily loaded routing engines
level: high
---
title: Suspicious Shell Execution via TACACS Session - Possible CVE-2026-102031
id: 5d1a9e63-7f48-4b23-a906-2e8c4f6b3d17
status: experimental
description: Detects Junos shell command execution containing shell metacharacters or injection patterns within TACACS accounting or login events, indicative of OS command injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102031
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: juniper
  service: syslog
detection:
  selection_tacacs:
    Message|contains:
      - 'TACACS'
      - 'tac_plus'
      - 'cmd='
  selection_inject:
    Message|contains:
      - '; sh'
      - '| sh'
      - '&& sh'
      - ';sh '
      - '|sh '
      - '$( '
      - '`sh'
      - 'start shell'
  condition: selection_tacacs and selection_inject
falsepositives:
  - Rare; legitimate TACACS accounting should never contain shell metacharacter sequences
level: critical

KQL (Microsoft Sentinel / Defender)

These queries assume Junos syslog is ingested via CEF/Syslog collectors. Run the first as an analytic rule (alert on any hit), the second as a hunting query to baseline crash frequency.

// Hunt 1: Junos daemon crashes, core dumps, and panic events (SVR/rpd overflow indicators)
// Schedule as analytic rule; alert on any result outside a change window
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("core dump", "SIGSEGV", "sigsegv", "signal 11", "panic", "RPD_EXIT", "RPD_FATAL")
| where SyslogMessage has_any ("svr", "rpd", "kernel")
| extend Component = extract(@"(?i)(svr|rpd|kernel)", 1, SyslogMessage)
| project TimeGenerated, Computer, HostIP, Component, SyslogMessage, Facility, SeverityLevel
| order by TimeGenerated desc

// Hunt 2: TACACS command injection patterns in Junos logs (CVE-2026-102031)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("TACACS", "tac_plus", "cmd=")
| where SyslogMessage matches regex @"(;\s*sh|\|\s*sh|&&\s*sh|\$\(|`sh|start shell)"
| project TimeGenerated, Computer, ProcessName, SyslogMessage

// Hunt 3: rpd restart storm baseline - flag devices with >3 rpd restarts per hour (pre-patch probing indicator)
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_all ("rpd", "exited") or SyslogMessage has "RPD_EXIT"
| summarize RestartCount = count() by Computer, bin(TimeGenerated, 1h)
| where RestartCount > 3
| order by RestartCount desc

// Hunt 4: Flow-layer anomaly - malformed/fragment-heavy IPv4 floods toward SRX SVR interfaces
CommonSecurityLog
| where TimeGenerated > ago(1h)
| where DeviceVendor == "Juniper Networks"
| summarize PacketCount = count() by SourceIP, DestinationIP, DeviceName, bin(TimeGenerated, 5m)
| where PacketCount > 50000
| order by PacketCount desc

Velociraptor VQL

If your SRX management-plane logs or your syslog collector servers are Velociraptor-monitored, hunt the collector for Juniper crash artifacts landing in log archives — useful during IR scoping to find which devices crashed and when.

-- Hunt Juniper crash/core artifacts in forwarded syslog archives on collector hosts
SELECT FullPath, Size, Mtime, Ctime,
       read_file(filename=FullPath, length=4096) AS LogSample
FROM glob(globs=['/var/log/remote/**/*.log', '/var/log/syslog-ng/**/*.log'])
WHERE FullPath =~ '(?i)(srx|junos|juniper)'
  AND (
    FullPath =~ '(?i)core'
    OR Mtime > now() - 86400
  )
ORDER BY Mtime DESC

-- Hunt for rpd/SVR crash strings across ingested device logs (IR scoping)
SELECT FullPath, Line, LineNumber
FROM foreach(
  row={
    SELECT FullPath FROM glob(globs='/var/log/remote/**/*.log')
    WHERE FullPath =~ '(?i)(srx|junos)'
  },
  query={
    SELECT FullPath, Line, LineNumber
    FROM parse_lines(filename=FullPath)
    WHERE Line =~ '(?i)(core dump|SIGSEGV|RPD_EXIT|RPD_FATAL|panic)'
  })
ORDER BY LineNumber DESC

Remediation & Verification Script

Run this from a jump host with SSH access to your Junos fleet to enumerate software versions, check SVR exposure, and collect crash evidence before and after patching. This is verification and evidence collection — patching itself must follow Juniper's upgrade procedure via request system software add.

#!/bin/bash
# CVE-2026-101950 / -101990 / -102031 fleet triage and verification script
# Requires: SSH key auth to Junos devices, netconf or CLI access
DEVICES="devices.txt"   # one management IP/FQDN per line
OUTDIR="junos_triage_$(date +%Y%m%d)"; mkdir -p "$OUTDIR"

while read -r DEV; do
  [ -z "$DEV" ] && continue
  echo "=== $DEV ==="
  # 1. Capture current Junos version for comparison against fixed releases
  ssh -o BatchMode=yes -o ConnectTimeout=10 admin@"$DEV" \
    "show version | match (Junos|Model)" | tee "$OUTDIR/${DEV}_version.txt"

  # 2. Check whether SVR is configured (CVE-2026-101950 attack surface)
  ssh -o BatchMode=yes admin@"$DEV" \
    "show configuration | display set | match svr" | tee "$OUTDIR/${DEV}_svr.txt"
  if [ -s "$OUTDIR/${DEV}_svr.txt" ]; then
    echo "[!] $DEV: SVR CONFIGURED - prioritize patching CVE-2026-101950"
  fi

  # 3. Check for existing crash artifacts (possible prior exploitation attempts)
  ssh -o BatchMode=yes admin@"$DEV" \
    "file list /var/crash detail" | tee "$OUTDIR/${DEV}_crash.txt"
  ssh -o BatchMode=yes admin@"$DEV" \
    "show system core-dumps" | tee -a "$OUTDIR/${DEV}_crash.txt"
  grep -qi "core" "$OUTDIR/${DEV}_crash.txt" && \
    echo "[!] $DEV: CORE DUMPS PRESENT - collect for IR review before upgrade"

  # 4. Review recent rpd/SVR crash log entries
  ssh -o BatchMode=yes admin@"$DEV" \
    "show log messages | match (rpd|svr|SIGSEGV|core) | last 50" \
    | tee "$OUTDIR/${DEV}_logs.txt"
done < "$DEVICES"

echo "Triage complete. Review $OUTDIR for SVR exposure and core dumps BEFORE upgrading."

Remediation

1. Identify affected versions immediately. Cross-reference your Junos OS release trains against the fixed versions listed in the Juniper Security Advisories (JSA) at https://supportportal.juniper.net and the NVD entries for each CVE (starting with https://nvd.nist.gov/vuln/detail/CVE-2026-101950). At publication time these CVEs are days old — pull the JSA bulletin for the authoritative fixed-version list rather than relying on secondhand summaries.
2. Patch in this order: (a) internet-facing SRX clusters with SVR enabled (CVE-2026-101950 — pre-auth, data-plane reachable), (b) devices running TACACS AAA (CVE-2026-102031), (c) BGP/IGP-speaking routers exposed to untrusted peers (CVE-2026-101990), then (d) everything else running affected trains. Use request system software add with validated Junos images and follow your HA upgrade runbook to avoid cluster failover surprises.
3. Interim mitigations while patching is scheduled:
   • CVE-2026-101950: If SVR is not business-critical on a given interface, disable it. If it is, apply strict inbound firewall filters (loopback/RE protection filters) limiting IPv4 traffic to SVR interfaces to known, expected tunnel endpoints only.
   • CVE-2026-101990: Ensure routing-protocol authentication is enforced (BGP MD5/TCP-AO, OSPF authentication), apply prefix/AS-path sanity filters, and restrict which peers can establish sessions via firewall filters on the RE.
   • CVE-2026-102031: Restrict TACACS reachability to known AAA servers via RE protection filters; audit TACACS accounting for anomalies; if feasible, temporarily fail over to RADIUS or local auth until patched.
4. Preserve evidence before upgrading. Core dumps and /var/log/messages are your only exploitation indicators on the box. Export them (file archive, SCP off-box) before any request system reboot or software add, per the triage script above.
5. Hunt retroactively. Run the KQL hunts above against 30+ days of retained syslog. An rpd crash pattern that started before the disclosure date is a scoping trigger, not a coincidence.
6. Monitor CISA KEV daily. Given the severity class and Juniper's exploitation history, expect KEV additions; if any of these land there, federal deadlines (typically ~2 weeks for FCEB) become your de facto private-sector SLA.

Bottom Line

Seven critical network-exploitable CVEs on Junos OS — three at CVSS 9.8, one reachable by simply sending packets to a perimeter firewall interface — is an emergency-patch scenario. The pre-PoC window is open right now. Patch the edge first, restrict SVR and TACACS reachability as a compensating control, preserve crash artifacts for IR, and keep hunting. Perimeter devices are where breaches start; treat these CVEs accordingly.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub