CVE-2026-102175: Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is used

Published Oct 14, 2026

Updated

A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection.

Affected Software

2 affected components

Juniper Networks Junos OS

Juniper Networks Junos OS Evolved

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Juniper Networks Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 23.2R2-S7.7-EVO
Upgrade
Upgrade Juniper Networks Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 23.4R2-S8.11-EVO
Upgrade
Upgrade Juniper Networks Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.2R2-S5.6-EVO
Upgrade
Upgrade Juniper Networks Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.4R2-S5-EVO
Upgrade
Upgrade Juniper Networks Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.2R2-S2-EVO
Upgrade
Upgrade Juniper Networks Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.2X100-D35-EVO
Upgrade
Upgrade Juniper Networks Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4R1-S3-EVO
Upgrade
Upgrade Juniper Networks Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4R2-EVO
Upgrade
Upgrade Juniper Networks Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4X300-D40-EVO
Upgrade
Upgrade Juniper Networks Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.2R1-S2-EVO
Upgrade
Upgrade Juniper Networks Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.2R2-EVO
Upgrade
Upgrade Juniper Networks Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.4R1-EVO
Upgrade
Upgrade Juniper Networks Junos OS to a version that resolves this vulnerability.
Fixed in 23.2R2-S7.7
Upgrade
Upgrade Juniper Networks Junos OS to a version that resolves this vulnerability.
Fixed in 23.4R2-S8.13
Upgrade
Upgrade Juniper Networks Junos OS to a version that resolves this vulnerability.
Fixed in 24.2R2-S5.5
Upgrade
Upgrade Juniper Networks Junos OS to a version that resolves this vulnerability.
Fixed in 24.4R2-S5
Upgrade
Upgrade Juniper Networks Junos OS to a version that resolves this vulnerability.
Fixed in 25.2R2-S2
Upgrade
Upgrade Juniper Networks Junos OS to a version that resolves this vulnerability.
Fixed in 25.4R1-S3
Upgrade
Upgrade Juniper Networks Junos OS to a version that resolves this vulnerability.
Fixed in 25.4R2
Upgrade
Upgrade Juniper Networks Junos OS to a version that resolves this vulnerability.
Fixed in 26.2R1-S2
Upgrade
Upgrade Juniper Networks Junos OS to a version that resolves this vulnerability.
Fixed in 26.2R2
Upgrade
Upgrade Juniper Networks Junos OS to a version that resolves this vulnerability.
Fixed in 26.4R1

Event History

Oct 14, 2026

CVE Published

via MITRE·04:56 PM

Data Sourced

via MITRE·04:56 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Junos OS and Junos OS Evolved deployments that use service-deployment processing and have a configured SDX/SRC server connection are exposed if an attacker can control or intercept that connection.

Does exploitation require credentials or user interaction?

No. The issue is described as remotely exploitable by an unauthenticated attacker, with no user interaction required, provided the attacker can control or intercept the configured SDX/SRC server connection.

What level of access could an attacker obtain?

A crafted frame delivered over the service-deployment TCP connection can allow code execution as root. The same flaw can also be used to cause denial of service.

What should be prioritized if an immediate fix cannot be applied?

Prioritize protecting the configured SDX/SRC server connection from attacker control or interception, since access to that connection is the stated prerequisite for exploitation.