CVE-2026-101973: CWE-476 NULL Pointer Dereference in Juniper Networks Junos OS

This vulnerability (CVE-2026-101973) involves a NULL Pointer Dereference in the pkid component of Juniper Networks Junos OS. An unauthenticated remote attacker can trigger a denial of service condition by sending a malformed packet during CMP enrollment or automatic certificate re-enrollment processes. The flaw affects several version ranges of Junos OS prior to fixed releases. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (denial of service).

Successful exploitation results in denial of service of the affected Junos OS device. There is no impact on confidentiality or integrity. The attack can be performed remotely without authentication or user interaction, potentially disrupting network operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fix information is provided, users should monitor Juniper Networks advisories for updates and apply patches once available. Until then, consider limiting exposure of CMP enrollment interfaces to untrusted networks if possible.