# CVE-2026-57029

## Summary

- **CVE ID:** CVE-2026-57029
- **Severity:** MEDIUM
- **CVSS Score:** 6 (CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/RE:M)
- **CWE:** CWE-820
- **Published:** Jul 9, 2026
- **Last Modified:** Jul 10, 2026

## Description

A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS).


When the reachability of an sFlow collector changes, the corresponding next-hop entry is updated. If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed.




This issue affects Junos OS Evolved on QFX Series:


  *  all 23.2 versions, 
  *  23.4 versions before 23.4R2-S7-EVO,
  *  24.2 versions before 24.2R2-S5-EVO,
  *  24.4 versions before 24.4R2-S3-EVO,
  *  25.2 versions before 25.2R2-EVO.

## Affected Products

- Juniper Networks — Junos OS Evolved (0)
- Juniper Networks — Junos OS Evolved (24.2)
- Juniper Networks — Junos OS Evolved (24.4)
- Juniper Networks — Junos OS Evolved (25.2)

## References

- [CNA](https://supportportal.juniper.net/JSA110089)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.19%
- **EPSS Percentile:** 8.7

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-09._