advanced forwarding toolkit (evo-aftmand)
of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated network-based attacker generating continuous routing updates, resulting in unilist ECMP routes, to crash the
evo-aftmand process on the PFE, leading to a Denial-of-Service (DoS). The conditions required for successful exploitation are based on a sequence of events that are outside an attacker's direct control.
Unified list (unilist) ECMP routes are a specific ECMP behavior where multiple equal-cost routes share a single logical next-hop list entry. The router treats them as one route with multiple next hops and load balances traffic across that unified list. Due to an issue processing unilist ECMP routing updates, internal state corruption may occur, especially in large-scale ECMP unilist deployments, leading to the evo-aftmand process crashing, resulting in an evo-aftmand-bx core. Manual intervention is required to recover by rebooting the system or restarting the FPC.
This issue affects Junos OS Evolved on PTX :
* from 24.4R2-EVO before 24.4R2-S3-EVO;
* from 25.2 before 25.2R2-EVO.
Project Subscriptions
| Vendors | Products |
|---|---|
|
Juniper
Subscribe
|
Junos Os Evolved
Subscribe
Ptx1000-72q
Subscribe
Ptx10000
Subscribe
Ptx10001
Subscribe
Ptx10001-36mr
Subscribe
Ptx100016
Subscribe
Ptx10002
Subscribe
Ptx10002-36qdd
Subscribe
Ptx10002-60c
Subscribe
Ptx10003
Subscribe
Ptx10003 160c
Subscribe
Ptx10003 80c
Subscribe
Ptx10003 81cd
Subscribe
Ptx10004
Subscribe
Ptx10008
Subscribe
Ptx10016
Subscribe
Ptx12008
Subscribe
Ptx3000
Subscribe
Ptx5000
Subscribe
|
|
Juniper Networks
Subscribe
|
Junos Os Evolved
Subscribe
|
No advisories yet.
Solution
The following software releases have been updated to resolve this specific issue: Junos OS Evolved: 24.4R2-S3-EVO, 25.2R2-EVO, 25.4R1-EVO, and all subsequent releases.
Workaround
There are no known workarounds for this issue.
| Link | Providers |
|---|---|
| https://supportportal.juniper.net/JSA110073 |
|
Fri, 10 Jul 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 09 Jul 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Juniper Networks
Juniper Networks junos Os Evolved |
|
| Vendors & Products |
Juniper Networks
Juniper Networks junos Os Evolved |
Thu, 09 Jul 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An Improper Check for Unusual or Exceptional Conditions vulnerability in the advanced forwarding toolkit (evo-aftmand) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated network-based attacker generating continuous routing updates, resulting in unilist ECMP routes, to crash the evo-aftmand process on the PFE, leading to a Denial-of-Service (DoS). The conditions required for successful exploitation are based on a sequence of events that are outside an attacker's direct control. Unified list (unilist) ECMP routes are a specific ECMP behavior where multiple equal-cost routes share a single logical next-hop list entry. The router treats them as one route with multiple next hops and load balances traffic across that unified list. Due to an issue processing unilist ECMP routing updates, internal state corruption may occur, especially in large-scale ECMP unilist deployments, leading to the evo-aftmand process crashing, resulting in an evo-aftmand-bx core. Manual intervention is required to recover by rebooting the system or restarting the FPC. This issue affects Junos OS Evolved on PTX : * from 24.4R2-EVO before 24.4R2-S3-EVO; * from 25.2 before 25.2R2-EVO. | |
| Title | Junos OS Evolved: PTX Series: Receipt of repeated ECMP routing updates results in PFE crash | |
| Weaknesses | CWE-754 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: juniper
Published:
Updated: 2026-07-10T14:22:17.928Z
Reserved: 2026-03-23T19:46:13.673Z
Link: CVE-2026-33794
Updated: 2026-07-10T14:22:14.539Z
Status : Analyzed
Published: 2026-07-09T21:16:54.790
Modified: 2026-07-13T12:57:12.750
Link: CVE-2026-33794
No data.
OpenCVE Enrichment
Updated: 2026-07-31T13:30:17Z