CVE-2026-21903

Estado: AnalizadaAlta (7.1)—

A Stack-based Buffer Overflow vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS allows a network-based attacker, authenticated with low privileges to cause a Denial-of-Service (DoS).

Subscribing to telemetry sensors at scale causes all FPC connections to drop, resulting in an FPC crash and restart. The issue was not seen when YANG packages for the specific sensors were installed.

This issue affects Junos OS:

Detalles técnicos trazas, registros y código del informe original

  *  all versions before 22.4R3-S7,
  *  23.2 version before 23.2R2-S4,
  *  23.4 versions before 23.4R2.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 7.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.40%
Percentil entre todas las CVEs puntuadas: 33
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement60 %
Impacto principalT1499 Endpoint Denial of Serviceimpact55 %

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Threat Intelligence Program Privileged Account Management Network Segmentation Filter Network Traffic Disable or Remove Feature or Program

Tecnologías afectadas (1)

Juniper — Junos

CWE

CWE-121

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-21903",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-21903",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-15T21:12:00.833031Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "sirt@juniper.net",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "sirt@juniper.net",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "sirt@juniper.net",
      "affectedData": [
        {
          "vendor": "Juniper Networks",
          "product": "Junos OS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "22.4R3-S7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "23.2",
              "lessThan": "23.2R2-S4",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "23.4",
              "lessThan": "23.4R2",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-15T21:16:05.807",
  "references": [
    {
      "url": "https://kb.juniper.net/JSA106022",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "sirt@juniper.net"
    },
    {
      "url": "https://supportportal.juniper.net/JSA106022",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "sirt@juniper.net"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "sirt@juniper.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Stack-based Buffer Overflow vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS allows a network-based attacker, authenticated with low privileges to cause a Denial-of-Service (DoS).\n\n\n\nSubscribing to telemetry sensors at scale causes all FPC connections to drop, resulting in an FPC crash and restart.\nThe issue was not seen when YANG packages for the specific sensors were installed. \n\n\n\nThis issue affects Junos OS: \n\n\n\n  *  all versions before 22.4R3-S7,\n  *  23.2 version before 23.2R2-S4,\n  *  23.4 versions before 23.4R2."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de desbordamiento de búfer basado en pila en el Motor de Reenvío de Paquetes (pfe) de Juniper Networks Junos OS permite a un atacante basado en red, autenticado con privilegios bajos, causar una Denegación de Servicio (DoS).\n\nLa suscripción a sensores de telemetría a escala provoca la caída de todas las conexiones FPC, lo que resulta en un fallo y reinicio de la FPC.\nEl problema no se observó cuando se instalaron los paquetes YANG para los sensores específicos.\n\nEste problema afecta a Junos OS:\n\n*   todas las versiones anteriores a 22.4R3-S7,\n*   versión 23.2 anterior a 23.2R2-S4,\n*   versiones 23.4 anteriores a 23.4R2."
    }
  ],
  "lastModified": "2026-06-17T10:19:07.297",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57F66641-003B-49D6-A9B9-AB300CFE3C93",
              "versionEndExcluding": "22.4"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1379EF30-AF04-4F98-8328-52A631F24737"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28E42A41-7965-456B-B0AF-9D3229CE4D4C"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB1A77D6-D3AD-481B-979C-8F778530B175"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A064B6B-A99B-4D8D-A62D-B00C7870BC30"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40813417-A938-4F74-A419-8C5188A35486"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r2-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FC1BA1A-DF0E-4B15-86BA-24C60E546732"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r2-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EBB967BF-3495-476D-839A-9DBFCBE69F91"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E5688D6-DCA4-4550-9CD1-A3D792252129"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r3-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8494546C-00EA-49B6-B6FA-FDE42CA5B1FA"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r3-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8BB98579-FA33-4E41-A162-A46E9709FBD3"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r3-s3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08E2562F-FB18-4347-8497-7D61B8157EBB"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r3-s4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "494D1D96-1DA2-4B0A-9536-1B5A4FDFCA09"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r3-s5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60A1E37B-1990-44D9-87FE-300678243BE2"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r3-s6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D306ED88-8700-4FD4-8919-3C85728C04C3"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A78CC80-E8B1-4CDA-BB35-A61833657FA7"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B3B2FE1-C228-46BE-AC76-70C2687050AE"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1B16FF0-900F-4AEE-B670-A537139F6909"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B227E831-30FF-4BE1-B8B2-31829A5610A6"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1ADA814B-EF98-45B1-AF7A-0C89688F7CA5"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6FB32DF-D062-4FB9-8777-452978BEC7B7"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B3B6C811-5C10-4486-849D-5559B592350A"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "078D61B9-A228-453C-9D20-6F9C6B20637F"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78481ABC-3620-410D-BC78-334657E0BB75"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE8A5BA3-87BD-473A-B229-2AAB2C797005"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B74AC3E-8FC9-400A-A176-4F7F21F10756"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB2D1FCE-8019-4CE1-BA45-D62F91AF7B51"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "sirt@juniper.net"
}