CVE-2026-57027: junos 23.2, 23.4, 24.2 (+1 more affected versions); +1 more affected products

Affected technology

junos · before 23.2 (exclusive)
juniper

junos · 23.2
juniper

junos · 23.2 · update r1
juniper

junos · 23.2 · update r1-s1
juniper

junos · 23.2 · update r1-s2
juniper

junos · 23.2 · update r2
juniper

junos · 23.2 · update r2-s1
juniper

junos · 23.2 · update r2-s2
juniper

junos · 23.2 · update r2-s3
juniper

junos · 23.2 · update r2-s4
juniper

junos · 23.2 · update r2-s5
juniper

junos · 23.2 · update r2-s6
juniper

junos · 23.4
juniper

junos · 23.4 · update r1
juniper

junos · 23.4 · update r1-s1
juniper

junos · 23.4 · update r1-s2
juniper

junos · 23.4 · update r2
juniper

junos · 23.4 · update r2-s1
juniper

junos · 23.4 · update r2-s2
juniper

junos · 23.4 · update r2-s3
juniper

junos · 23.4 · update r2-s4
juniper

junos · 23.4 · update r2-s5
juniper

junos · 23.4 · update r2-s6
juniper

junos · 24.2
juniper

junos · 24.2 · update r1
juniper

junos · 24.2 · update r1-s1
juniper

junos · 24.2 · update r1-s2
juniper

junos · 24.2 · update r2
juniper

junos · 24.2 · update r2-s1
juniper

junos · 24.2 · update r2-s2
juniper

junos · 24.2 · update r2-s3
juniper

junos · 24.4
juniper

junos · 24.4 · update r1
juniper

junos · 24.4 · update r1-s2
juniper

junos · 24.4 · update r1-s3
juniper

Junos OS · 0 to before 23.2R2-S7, 23.4 to before 23.4R2-S7, 24.2 to before 24.2R2-S4, 24.4 to before 24.4R2
Juniper Networks

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Adjacent network · No privileges required · No user interaction required

What an attacker can do

The source says a Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series devices allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS).When sFlow is configured in a Virtual Chassis (VC) scenario with EX4100 Series or EX4400 Series devices, multicast traffic which is received on one VC member and sent out on another member leads to a memory leak and ultimately an FPC crash and restart. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality and integrity impact as none; availability impact as high.