High priorityDisclosed

Advisory · CVE-2026-101927

Heap overflow in Junos eventd lets a local user escalate to root

A heap-based buffer overflow in eventd on Junos OS and Junos OS Evolved lets an unprivileged local attacker cause a denial of service or escalate privileges to root with crafted IPC event messages. Juniper rates it CVSS 4.0 8.6 (CVSS 3.1 7.8).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-101927
CWE-122
Action timing
Immediate
ELI5

Explain it like I’m five

A local user who can talk to the event daemon can overflow it and walk out with root.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Local access obtained

    An unprivileged local user reaches the eventd IPC interface.

  2. 02Crafted event sent

    The attacker sends IPC event messages sized to overflow eventd's heap buffer.

  3. 03Root or crash

    The overflow escalates the attacker to root or denies service.

What happened

Juniper disclosed CVE-2026-101927 in its October 2026 security release: a heap-based buffer overflow (CWE-122) in eventd on all platforms running Junos OS or Junos OS Evolved. An unprivileged local attacker can send crafted IPC event messages to crash the daemon or escalate to root.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for eventd crashes and privilege changes tied to local accounts on network devices.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Local privilege escalation on a network device turns a foothold into ownership. Patch and review who holds shell access.