{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-103994", "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "state": "PUBLISHED", "assignerShortName": "juniper", "dateReserved": "2026-10-01T16:12:05.397Z", "datePublished": "2026-10-14T16:16:02.937Z", "dateUpdated": "2026-10-15T03:57:20.000Z" }, "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Junos OS", "vendor": "Juniper Networks", "versions": [ { "lessThan": "23.2R2-S7.7", "status": "affected", "version": "0", "versionType": "custom" }, { "lessThan": "23.4R2-S8.13", "status": "affected", "version": "23.4", "versionType": "custom" }, { "lessThan": "24.2R2-S5.5", "status": "affected", "version": "24.2", "versionType": "custom" }, { "lessThan": "24.4R2-S5", "status": "affected", "version": "24.4", "versionType": "custom" }, { "lessThan": "25.2R2-S2", "status": "affected", "version": "25.2", "versionType": "custom" }, { "lessThan": "25.4R1-S3", "status": "affected", "version": "25.4", "versionType": "custom" }, { "lessThan": "26.2R1-S2", "status": "affected", "version": "26.2", "versionType": "custom" } ] } ], "configurations": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "[ protocols ovsdb controller ]" } ], "value": "[ protocols ovsdb controller ]" } ], "datePublic": "2026-10-14T14:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution.


" } ], "value": "A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution." } ], "exploits": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability." } ], "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] }, { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper", "dateUpdated": "2026-10-14T16:35:58.931Z" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://supportportal.juniper.net/JSA112188" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": true, "type": "text/html", "value": "The following software releases have been updated to resolve this specific issue:
\n
\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.

Note: For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory." } ], "value": "The following software releases have been updated to resolve this specific issue:\n\n\n\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.\n\nNote: For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory." } ], "source": { "advisory": "JSA112188", "defect": [ "1950782" ], "discovery": "INTERNAL" }, "title": "Junos OS: A crafted OVSDB message crashes vgd and allows remote code execution", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "There are no known workarounds for this issue." } ], "value": "There are no known workarounds for this issue." } ], "x_generator": { "engine": "Vulnogram 0.1.0-dev" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-10-14T00:00:00+00:00", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-103994" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T03:57:20.000Z" } } ] } }