Incorrect Calculation Vulnerability in Junos OS Evolved by Juniper Networks
CVE-2026-21911

7.1HIGH

Key Information:

Vendor

Juniper Networks
Status
Junos Os Evolved
Vendor
CVE Published:
15 January 2026

Badges

👾 Exploit Exists

What is CVE-2026-21911?

An incorrect calculation vulnerability in the Layer 2 Control Protocol Daemon (l2cpd) of Juniper Networks' Junos OS Evolved allows unauthenticated attackers in close proximity to disrupt the management interface. This can lead to a failure in learning new MAC addresses over label-switched interfaces (LSI), consequently causing significant log flooding and increased CPU usage. The resulting behavior generates a specific log message indicating the critical status of the operations affected. To mitigate this issue, it is vital for users to update to the latest recommended versions of Junos OS Evolved.

Affected Version(s)

Junos OS Evolved 0 < 21.4R3-S7-EVO

Junos OS Evolved 22.2 < 22.2R3-S4-EVO

Junos OS Evolved 22.3 < 22.3R3-S3-EVO

References

https://supportportal.juniper.net/JSA106010
vendor-advisory
https://kb.juniper.net/JSA106010
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.