IT SBIT Services
Schneeberger
DEEN
CVE tracker

Juniper Junos OS: Stack-based buffer overflow in cfmd allows code execution

CVE-2026-102055High 8.7

← All vulnerabilities

Summary

A stack-based buffer overflow in the cfmd process of Junos OS on MX Series and Junos OS Evolved on PTX Series routers can be triggered by a specific CFM message sent to a configured down-MEP with enhanced CFM mode enabled. An unauthenticated attacker on the same adjacent network segment can execute arbitrary code as root or cause a denial of service. Juniper SIRT is not aware of any malicious exploitation, and CISA SSVC rates exploitation as none.

Affected

  • Junos OS: releases before 23.2R2-S7.7, 23.4 to before 23.4R2-S8.13, 24.2 to before 24.2R2-S5.5, 24.4 to before 24.4R2-S5, 25.2 to before 25.2R2-S2, 25.4 to before 25.4R1-S3, 26.2 to before 26.2R1-S2 (MX Series)
  • Junos OS Evolved: releases before 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 26.2R1-S2-EVO and specific 23.4X100, 25.2X100, 25.4X300 builds (PTX Series)
  • Exposure requires enhanced CFM mode and a configured down-MEP

Fixed in

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and later
  • Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and later
  • Some releases (23.2, 23.4, 24.2 and their EVO variants) are fixed by rebuilt respins; check the exact respin in JSA112187

Workaround

  • Juniper's advisory states there are no known workarounds for this issue.
  • Reviewing whether enhanced CFM and down-MEP are required and restricting CFM traffic to trusted interfaces may reduce exposure; this is not a vendor recommendation and has not been confirmed.

Exploitation

  • Juniper SIRT is not aware of any malicious exploitation.
  • KEV: not listed. EPSS: not available.
  • No public proof of concept was found in a limited search.
  • CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

  • Check whether you operate Junos OS MX Series or Junos OS Evolved PTX Series devices, using show version; typical SME SRX or EX hardware is not in the listed ranges.
  • If affected, upgrade to the fixed release or respin listed in JSA112187 as soon as possible.
  • Verify whether enhanced CFM with down-MEP is in use and restrict CFM traffic to trusted segments until patched.
  • Review other Junos vulnerabilities in the same bulletin, especially any exposed J-Web interface.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:13.

Original description (NVD)

A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent to a configured down-MEP with enhanced CFM mode enabled.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed