Security readout for executives and security teams
Plain-English summary
CVE-2026-21909 can let a neighboring IS-IS routing device crash Juniper’s routing process by repeatedly sending a specific update. The impact is denial of service, not data theft or code execution. Risk is highest for networks where untrusted or compromised devices can form IS-IS adjacencies with affected Junos routers.
Executive priority
High priority for routing environments using IS-IS on affected Juniper releases. The business risk is network instability or outage if a trusted-adjacent device is compromised or unauthorized. Patch during the next urgent network maintenance window, prioritizing core and aggregation routers.
Technical view
A CWE-401 memory leak in rpd affects Junos OS and Junos OS Evolved 23.2, 23.4, and 24.1 before specified fixed releases. An unauthenticated attacker controlling an adjacent IS-IS neighbor can trigger memory exhaustion through specific update packets, causing rpd to crash. CVSS v4.0 score is 7.1, availability impact high.
Likely exposure
Exposure requires an adjacent IS-IS neighbor. Internet-wide exposure is unlikely unless IS-IS adjacency is reachable from untrusted networks. Organizations using affected Junos versions with IS-IS enabled should treat compromised or unauthorized routing peers as the main risk.
Exploitation context
The sources do not report active exploitation, and the CVE is not marked KEV. Exploitation requires adjacency in the IS-IS routing domain and continued receipt of crafted updates to exhaust memory. This is a service availability risk for routing infrastructure.
Researcher notes
The advisory identifies the vulnerable component, affected release trains, fixed releases, trigger condition, and memory monitoring indicator. It does not provide public exploit code or report exploitation. Avoid assuming remote Internet exploitation; the attack vector is adjacent IS-IS neighbor access.
Mitigation direction
- Upgrade Junos OS to 23.2R2, 23.4R1-S2, 23.4R2, 24.1R2, or later fixed releases.
- Upgrade Junos OS Evolved to 23.2R2-EVO, 23.4R1-S2-EVO, 23.4R2-EVO, 24.1R2-EVO, or later.
- Review Juniper advisory JSA106008 for platform-specific guidance and any operational workarounds.
- Prioritize routers running IS-IS with adjacencies outside tightly trusted infrastructure.
Validation and detection
- Inventory Junos OS and Junos OS Evolved devices and compare versions against affected ranges.
- Confirm whether IS-IS is enabled and which neighbors can form adjacencies.
- Monitor rpd memory usage as described in the Juniper advisory.
- Review logs and telemetry for rpd crashes or repeated memory growth.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-21909 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M/U:Green
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M/U:Green——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
7.1HighVector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M/U:Green
Source materials
- CVE List V5 sourceCVE List V5
- https://supportportal.juniper.net/JSA106008CVE reference · vendor-advisory
- https://kb.juniper.net/JSA106008CVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.