NI vulnerabilities and threats

CVE-2026-102174 is a stack-based buffer overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series. It allows an authenticated remote-access VPN client to execute code with root privileges or cause a denial of service. The vulnerability affects multiple Junos OS versions prior to specific patch releases. The CVSS score is 8.8, indicating high severity.

CVE-2026-102061 is a stack-based buffer overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an adjacent unauthenticated attacker to execute arbitrary code as root by sending a crafted DHCP SZTP bootstrap message. This vulnerability affects only platforms that support Secure-ZTP. The issue has a high severity with a CVSS score of 8.8.

CVE-2026-102060 is a NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series. An unauthenticated adjacent attacker can cause a denial of service by sending an IGMPv3 membership report on a directly connected network. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS score is 6.5 (medium severity) with no confidentiality or integrity impact, only availability impact.

CVE-2026-102059 is an OS command injection vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX, SRX, and QFX Series devices. An adjacent unauthenticated attacker can exploit this flaw by using a rogue DHCP server to execute arbitrary commands with root privileges. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. It has a high severity with a CVSS score of 8.8. No known exploits in the wild have been reported. The vendor has not provided explicit patch links in the provided data, so patch status should be verified with Juniper advisories.

CVE-2026-102058 is a reachable assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms. It allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon through crafted BFD session traffic. The vulnerability has a CVSS v3.1 score of 6.5, indicating medium severity. Multiple versions of Junos OS and Junos OS Evolved are affected, with no explicit patch information provided.

CVE-2026-102057 is a stack-based buffer overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS. It allows an unauthenticated adjacent attacker to cause a denial of service by sending a crafted DHCP client response. This affects DHCP client operations and can disrupt DHCP, relay, and zero-touch-provisioning services. The vulnerability has a high severity with a CVSS score of 7.5. Multiple versions of Junos OS prior to specific patch releases are affected. No known exploits are reported in the wild at this time.

CVE-2026-102056 is a high-severity out-of-bounds read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated attacker on an adjacent network can send a crafted CFM message to a configured interface, causing the daemon to crash and potentially disclose limited process memory. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS 3.1 base score is 7.1, indicating a high impact primarily due to availability disruption and limited confidentiality loss.

CVE-2026-102055 is a stack-based buffer overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms. It allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service by sending a specific CFM message to a configured down-MEP with enhanced CFM mode enabled. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS v3.1 base score is 8.8, indicating high severity.

CVE-2026-102054 is a medium severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the L2ALM component. It involves improper handling of length parameter inconsistencies that allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory by sending VXLAN overlay-ping traffic to a local VTEP. The vulnerability does not impact confidentiality, integrity, or availability beyond limited information disclosure. Multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases are affected.

CVE-2026-102053 is a medium severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms. It involves improper release of memory before removing the last reference in the l2ald process, which can be triggered by a configured EVPN peer. This flaw allows denial of service through memory exhaustion during EVPN-VXLAN active-active multihoming route processing.

CVE-2026-102052 is a stack-based buffer overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms. It can be triggered by an adjacent unauthenticated attacker via a malformed DHCPv4 server response when the DHCPv4 local-client feature is enabled. Successful exploitation may lead to denial of service or arbitrary code execution with root privileges. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS v3.1 base score is 8.8, indicating high severity.

CVE-2026-102051 is a medium severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved platforms affecting the l2cpd process. It involves improper release of memory before removing the last reference, which can be triggered by an adjacent unauthenticated attacker via LLDP traffic when fast receive processing is enabled. This can cause memory exhaustion in l2cpd and disrupt Layer 2 control-plane operations.

CVE-2026-102050 is a stack-based buffer overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated adjacent attacker to cause a denial of service by sending crafted LLDP packets to an interface configured for LLDP. This can disrupt LLDP and other Layer 2 control protocols on the device. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific fixed releases. The CVSS v3.1 score is 8.8, indicating high severity.

CVE-2026-102049 is a stack-based buffer overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via LLDP traffic on interfaces with Unified Access Policy enabled. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific fixed releases. The CVSS 3.1 score is 8.8, indicating high severity.

CVE-2026-102048 is a resource allocation vulnerability in the l2cpd process of Juniper Networks Junos OS. It allows an adjacent unauthenticated attacker to cause denial of service and restart of the l2cpd process via FNP-enabled Layer 2 interfaces. The issue occurs when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation. All Junos OS platforms except PTX and SRX Series are affected.

CVE-2026-102047 is a medium severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the l2cpd process. It involves improper validation of consistency within input, allowing an adjacent unauthenticated Layer 2 attacker to cause denial of service in Layer 2 control protocols by sending a crafted MVRP Ethernet frame to an MVRP-enabled interface. The vulnerability does not impact confidentiality or integrity but causes availability disruption. No known exploits are reported in the wild. Affected versions span multiple releases prior to specific patch levels.

CVE-2026-102046 is a high-severity vulnerability in Juniper Networks Junos OS affecting MX Series devices. It involves an infinite loop in the netsctp.ko kernel module triggered by crafted SCTP network traffic. This flaw allows an unauthenticated remote attacker to cause a denial of service by making the device enter an unreachable loop state. The vulnerability affects multiple Junos OS versions prior to specific patch releases. No known exploits are reported in the wild as of the publication date.

CVE-2026-102045 is an out-of-bounds write vulnerability in the lacpd component of Juniper Networks Junos OS Evolved. It allows a Layer-2-adjacent attacker to cause a denial of service by sending a crafted frame to an LACP-enabled aggregated-Ethernet member port. The vulnerability affects multiple specific versions of Junos OS Evolved. The CVSS score is 6.5, indicating a medium severity impact focused on availability disruption without confidentiality or integrity impact.

CVE-2026-102044 is a Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. It allows a configured BGP-LS peer to cause a denial of service via a BGP-LS update. The vulnerability has a high severity with a CVSS score of 7.5 and affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch levels.

CVE-2026-102043 is a numeric truncation error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. An adjacent attacker can exploit this flaw via MPLS-TE fast-reroute signaling to crash the routing process, causing a denial of service. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS score is 6.5 (medium severity), indicating a significant impact on availability but no confidentiality or integrity loss. No known exploits are reported in the wild, and no official patch information is provided in the input data.