CVE-2026-57029
Juniper Junos Os Evolved 23.2 … 25.2
Raw vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:XSummary
CVE-2026-57029 is a medium-severity Missing Synchronization (CWE-820) vulnerability in Juniper Junos Os Evolved. Its CVSS base score is 6.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-7 (Boundary Protection) and SC-5 (Denial-of-service Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-42718
Vulnerability Data
A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS). When the reachability of an sFlow collector changes, the corresponding next-hop entry…
more
is updated. If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed. This issue affects Junos OS Evolved on QFX Series: * all 23.2 versions, * 23.4 versions before 23.4R2-S7-EVO, * 24.2 versions before 24.2R2-S5-EVO, * 24.4 versions before 24.4R2-S3-EVO, * 25.2 versions before 25.2R2-EVO.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows an adjacent unauthenticated attacker to trigger a crash in the evo-pfemand process via a race condition in the sFlow flow collector handler, directly enabling an application-layer DoS through exploitation of the affected service.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Boundary protection at the network edge can block or rate-limit unauthenticated adjacent sFlow traffic that triggers the next-hop race condition in the flow collector handler.
Denial-of-service protection mechanisms can limit the volume or frequency of sFlow collector reachability updates that induce the evo-pfemand crash.
System monitoring can detect anomalous sFlow collector state changes or repeated evo-pfemand restarts indicative of this race-condition DoS.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper concurrency controls and synchronization primitives during design and coding.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing synchronization through concurrency testing.
Secure SDLC practices can mandate concurrency controls and synchronization primitives.
Application security requirements can specify thread-safety and locking mechanisms.
Secure architecture principles include proper synchronization for shared resources.
Secure coding standards directly require synchronization primitives to prevent race conditions.