CVE-2026-102049: CWE-121 Stack-based Buffer Overflow in Juniper Networks Junos OS
Description
CVE-2026-102049 is a stack-based buffer overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via LLDP traffic on interfaces with Unified Access Policy enabled. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS v3.1 score is 8.8, indicating high severity.
CVSS v3.1
Score 8.8high
Affected software
Juniper Networks
Junos OS
Juniper Networks
Junos OS Evolved
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-102049) is a stack-based buffer overflow in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved. An attacker adjacent to the vulnerable device can send specially crafted LLDP traffic to an interface with Unified Access Policy enabled, triggering the overflow. Successful exploitation can lead to denial of service or arbitrary code execution with root privileges. The vulnerability affects a broad range of versions, including multiple release trains and variants of Junos OS and Junos OS Evolved, as detailed by the affected version ranges.
Potential Impact
An attacker without authentication and with adjacent network access can exploit this vulnerability to cause a denial of service or execute arbitrary code with root privileges on the affected device. This can lead to full system compromise, impacting confidentiality, integrity, and availability of the device and potentially the network it manages.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official patches or fixes are confirmed, restrict or monitor LLDP traffic on interfaces with Unified Access Policy enabled to reduce exposure. Follow Juniper Networks' official advisories for updates and apply patches promptly once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- juniper
- Date Reserved
- 2026-09-28T17:35:40.522Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acfb6692cdf04f6569794d4
Added to database: 10/14/2026, 17:05:45 UTC
Last enriched: 10/14/2026, 18:19:42 UTC
Last updated: 10/14/2026, 19:00:32 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.