CVE-2026-57025

MEDIUM
Published Jul 9, 2026 Modified Jul 13, 2026 CWE-466

Description

A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privilged attacker to cause a Denial-of-Service (DoS). On EX Series, QFX Series and MX Series a low-privileged attacker issuing a specific 'show l2-learning' command will cause an l2ald crash which will lead to a temporary service impact for all layer 2 services until the process has automatically restarted. This issue affects EX Series, QFX Series, MX Series: Junos OS: * all versions before 23.2R2-S7, * 23.4 versions before 23.4R2-S7, * 24.2 versions before 24.2R2, * 24.4 versions before 24.4R1-S2. Junos OS Evolved: * all versions before 23.2R2-S7-EVO, * 23.4 versions before 23.4R2-S8-EVO, * 24.2 versions before 24.2R2-EVO, * 24.4 versions before 24.4R1-S3-EVO.

Is your site exposed to CVE-2026-57025?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploit Prediction

0.0014
Probability of exploitation
0.04%
Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-466 CWE-466

Affected Products

Vendor Product
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper ex2300
juniper ex2300-c
juniper ex3400
juniper ex4000
juniper ex4100
juniper ex4100-f
juniper ex4100-h
juniper ex4100-h-12t
juniper ex4300
juniper ex4400
juniper ex4600
juniper ex4650
juniper ex9204
juniper ex9208
juniper ex9214
juniper mx10004
juniper mx10008
juniper mx2008
juniper mx2010
juniper mx2020
juniper mx204
juniper mx240
juniper mx301
juniper mx304
juniper mx480
juniper mx960
juniper qfx10008
juniper qfx10016
juniper qfx5110
juniper qfx5120
juniper qfx5130
juniper qfx5140
juniper qfx5200
juniper qfx5210
juniper qfx5220
juniper qfx5230-64cd
juniper qfx5240
juniper qfx5241
juniper qfx5250
juniper qfx5700
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper ex2300
juniper ex2300-c
juniper ex3400
juniper ex4000
juniper ex4100
juniper ex4100-f
juniper ex4100-h
juniper ex4100-h-12t
juniper ex4300
juniper ex4400
juniper ex4600
juniper ex4650
juniper ex9204
juniper ex9208
juniper ex9214
juniper mx10004
juniper mx10008
juniper mx2008
juniper mx2010
juniper mx2020
juniper mx204
juniper mx240
juniper mx301
juniper mx304
juniper mx480
juniper mx960
juniper qfx10008
juniper qfx10016
juniper qfx5110
juniper qfx5120
juniper qfx5130
juniper qfx5140
juniper qfx5200
juniper qfx5210
juniper qfx5220
juniper qfx5230-64cd
juniper qfx5240
juniper qfx5241
juniper qfx5250
juniper qfx5700

References

Frequently Asked Questions

What is CVE-2026-57025? +
A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privilged attacker to cause a Denial-of-Service (DoS). On EX Series, QFX Series and MX Series a low-privileged attacker issuing a specific 'show l2-learning' command will cause an l2ald crash which will lead to a temporary service impact for all layer 2 services until the process has automatically restarted. This issue affects EX Series, QFX Series, MX Series: Junos OS: * all versions before 23.2R2-S7, * 23.4 versions before 23.4R2-S7, * 24.2 versions before 24.2R2, * 24.4 versions before 24.4R1-S2. Junos OS Evolved: * all versions before 23.2R2-S7-EVO, * 23.4 versions before 23.4R2-S8-EVO, * 24.2 versions before 24.2R2-EVO, * 24.4 versions before 24.4R1-S3-EVO. It has a CVSS v3.1 base score of 5.5 (MEDIUM).
How severe is CVE-2026-57025? +
CVE-2026-57025 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0014, placing it in the 0th percentile for exploitation probability.
What products are affected by CVE-2026-57025? +
CVE-2026-57025 affects products from juniper, specifically: ex2300, ex2300-c, ex3400, ex4000, ex4100, ex4100-f, ex4100-h, ex4100-h-12t, ex4300, ex4400, ex4600, ex4650, ex9204, ex9208, ex9214, junos, junos_os_evolved, mx10004, mx10008, mx2008, mx2010, mx2020, mx204, mx240, mx301, mx304, mx480, mx960, qfx10008, qfx10016, qfx5110, qfx5120, qfx5130, qfx5140, qfx5200, qfx5210, qfx5220, qfx5230-64cd, qfx5240, qfx5241, qfx5250, qfx5700. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2026-57025? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-21849 7.5

When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause …
CVE-2024-33602 7.4

nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory …
CVE-2024-21591 9.8

An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, …
CVE-2025-52950 9.6

A Missing Authorization vulnerability in Juniper Networks Security Director allows an unauthenticated network-based attacker to read or tamper with multiple …
CVE-2025-59978 9.0

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker …
CVE-2024-21620 8.8

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J-Web of Juniper Networks Junos OS on …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2026-57025 — free, no signup required.