Advisory · CVE-2026-102014
Stack overflow in Junos authd lets a rogue RADIUS server run code as root
A stack-based buffer overflow in the authd process of Junos OS lets an attacker able to influence a configured RADIUS server crash authd or execute code with root privileges through a malicious RADIUS response. Juniper rates it CVSS 3.1 8.8.
- Vendor
- Juniper Networks
- Product
- Junos OS
- Identifier / CWE
- CVE-2026-102014
CWE-121 - Action timing
- Immediate
Explain it like I’m five
The device asks the RADIUS server who may log in, and a hostile answer can overflow the process asking the question.
- 01RADIUS request sent
The Junos device sends an authentication request to its configured RADIUS server.
- 02Malicious response returned
The influenced server answers with a response crafted to overflow authd.
- 03Root code or crash
The overflow executes code with root privileges or crashes authd.
What happened
Juniper disclosed CVE-2026-102014 in its October 2026 security release: a stack-based buffer overflow (CWE-121) in the authd process of Junos OS. An attacker who can influence a configured RADIUS server can answer with a malicious response that crashes authd or executes code with root privileges.
Juniper’s JSA112188 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.
What to do
- Inventory every Junos OS deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
- Review application and server logs for authd crashes following RADIUS responses and authentication outages on Junos devices.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Your AAA server is part of the device’s trusted core. Patch, and protect RADIUS paths with the same care as the devices themselves.