Juniper Networks Junos OS Critical Heap Overflow Allows Remote Root Access
A critical heap-based buffer overflow in Juniper's service-deployment daemon enables unauthenticated remote code execution as root on affected systems.
Key points
- CVE-2026-102175 is rated Critical with a CVSS score of 9.8.
- Attackers can execute code as root or cause denial of service via crafted frames.
- Vulnerabilities exist in multiple versions of Junos OS and Junos OS Evolved.
The National Vulnerability Database lists CVE-2026-102175 as a critical security flaw in Juniper Networks Junos OS. This heap-based buffer overflow vulnerability resides within the sdxd service-deployment daemon. Security researchers have assigned the flaw a CVSS base score of 9.8, indicating severe risk to affected infrastructure.
At a glance
- CVE
- CVE-2026-102175
- Product
- Juniper Networks Junos OS
- CVSS
- 9.8 Critical
- Weakness
- heap-based buffer overflow
- Exploited
- No known exploitation
A remote unauthenticated attacker can exploit this weakness to execute arbitrary code with root privileges. The attacker must be able to control or intercept the configured SDX/SRC server connection. By sending a crafted frame over the service-deployment TCP connection, the adversary can trigger the overflow. This action may also result in a denial of service condition on the targeted device.
Technical Context and Severity
The vulnerability is classified under CWE-122, which denotes a heap-based buffer overflow. This type of memory corruption error occurs when data is written beyond the allocated buffer space in heap memory. The sdxd daemon handles service deployment tasks, making it a critical component for network operations.
The NVD record provides two CVSS scores for this single CVE: 9.8 and 9.3. Both ratings fall within the critical severity range. The description remains consistent across both entries, highlighting the same attack vector and impact. Attackers do not need authentication to attempt exploitation, which increases the potential for widespread abuse if the service is exposed.
Affected Software Versions
Multiple release lines of Juniper Networks Junos OS are vulnerable to this issue. Affected versions include Junos OS before 23.2R2-S7.7 and before 23.4R2-S8.13. Users running Junos OS 24.2R2 before version S5.5 are also at risk. Additionally, Junos OS 24.4R2 versions prior to S5 contain this flaw.
Junos OS Evolved is similarly impacted across several release branches. Vulnerable versions include Junos OS Evolved before 23.2R2-S7.7-EVO and before 23.4R2-S8.11-EVO. The flaw also affects Junos OS Evolved 24.2R2 before S5.6-EVO. Finally, Junos OS Evolved 24.4R2 versions prior to S5-EVO are subject to this vulnerability.
What should you do?
Network administrators should immediately audit their environments to identify devices running the vulnerable software versions listed above. If a device is found to be affected, operators should restrict access to the SDX/SRC server connections. Monitoring for unusual TCP traffic on service-deployment ports can help detect potential exploitation attempts.
What to do and how to stay safe: Juniper Networks
- Inventory all Juniper devices to determine if they run vulnerable versions of Junos OS or Junos OS Evolved.
- Restrict network access to the sdxd service-deployment daemon to trusted sources only, preventing unauthenticated remote connections.
- Monitor logs and network traffic for anomalous activity on the service-deployment TCP connection that could indicate a crafted frame attack.
- Await official vendor updates or patches for the affected software versions, and apply them as soon as they become available.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-102175?
It is a critical heap-based buffer overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved.
Can an attacker exploit this without credentials?
Yes, the vulnerability allows a remote unauthenticated attacker to exploit the flaw if they can control or intercept the SDX/SRC server connection.
Which Junos OS versions are affected?
Junos OS versions before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5 are vulnerable.
