CVE-2026-101940 is a High (CVSS 7.5) NULL pointer dereference in the rpd routing daemon of Junos OS and Junos OS Evolved. A configured BGP peer can cause a denial of service with a BGP UPDATE when ISO-VPN and egress protection are configured. Check Juniper bulletin JSA112187 for fixed releases.
What's affected
The weakness is CWE-476 (NULL pointer dereference). The record says an unauthenticated, configured BGP peer can crash the routing protocol daemon by sending a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled. Both Junos OS and Junos OS Evolved are named.
The record gives no version list. Its single reference is Juniper bulletin JSA112187, which covers this CVE together with CVE-2026-101941, CVE-2026-101942 and CVE-2026-101943. Juniper's support portal would not load for us without a browser, so we could not read the affected and fixed release tables. Do not assume a version from this post. Read the bulletin for the table.
The vector is network, low complexity, no privileges, no user interaction, with high impact on availability only. The condition that matters is configuration: the issue applies when both ISO-VPN and egress protection are enabled. A router without that combination is outside the described exposure.
How to check if you're exposed
Start with the software version on each router.
show version
Compare it with the table in JSA112187. Then check the configuration. The record names ISO-VPN and egress protection, so search the configuration for both.
show configuration | display set | match egress-protection
Look for the ISO-VPN related configuration in your BGP and routing instance settings as well, using the names that Juniper uses in the bulletin. If neither is present, the described condition does not apply to that device.
Also list BGP peers, since the sender must be a configured peer.
show bgp summary
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Read JSA112187 and note the fixed releases for your platform and train.
- List devices running Junos OS or Junos OS Evolved with ISO-VPN and egress protection configured.
- Upgrade to a fixed release listed in the bulletin during your next maintenance window, or sooner for routers that peer with networks you do not control.
- Review BGP peer authentication and prefix filters, and limit peers to those you need.
- Watch for rpd restarts in the logs after the change.
Why it matters
A routing daemon restart drops adjacencies and routes. Even a short outage on a core router can be felt across a network, and repeated crashes can keep a router unstable. A NULL pointer dereference is a software error that crashes the process, so the main impact is availability.
The sender must be a configured BGP peer, which narrows the attacker pool to peers and anyone who can take over a peer session. The record does not mark it as known exploited, and we found no report of exploitation.
Quick check
Where do I find the affected releases?
In Juniper bulletin JSA112187, which the record references. We could not read its release tables, so we do not list versions here.
Do I need to be using BGP?
Yes. The record says a configured BGP peer sends the triggering update, and the issue applies when ISO-VPN and egress protection are configured.
Sources
Last reviewed: 18 October 2026.
