Product:
Junos OS
Summary
An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine of Junos OS on EX4k Series and QFX5k Series platforms allows an unauthenticated network-adjacent attacker to cause traffic between VXLAN Network Identifiers to drop, leading to a Denial of Service. This issue affects systems that support EVPN-VXLAN Virtual Port-Link Aggregation Groups, such as QFX5110, QFX5120, QFX5200, EX4100, EX4300, EX4400, and EX4650. Service can only be restored by restarting the affected FPC.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.1 | CVE-2026-21910 |
Exploitation
An attacker on the adjacent network can exploit this vulnerability by flapping an interface in an EVPN-VXLAN configuration Link Aggregation Group. This action causes Inter-VNI traffic to drop when there are multiple load-balanced next-hop routes for the same destination, resulting in a Denial of Service condition.
Affected Products
- QFX5110: Affected by the vulnerability in Junos OS.
- QFX5120: Affected by the vulnerability in Junos OS.
- QFX5200: Affected by the vulnerability in Junos OS.
- EX4100: Affected by the vulnerability in Junos OS.
- EX4300: Affected by the vulnerability in Junos OS.
- EX4400: Affected by the vulnerability in Junos OS.
- EX4650: Affected by the vulnerability in Junos OS.
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to a fixed version of Junos OS that is not affected by this issue. Regularly monitor and apply security updates from Juniper Networks to ensure that systems remain secure.