High priorityDisclosed

Advisory · CVE-2026-102015

Heap overflow in Junos 802.1X handling lets an adjacent attacker run code as root via EAPOL

A heap-based buffer overflow in the secure-dot1xd process of Junos OS and Junos OS Evolved lets an unauthenticated adjacent network attacker execute code as root or deny service with an EAPOL frame sent to an 802.1X-authenticated interface. Juniper rates it CVSS 3.1 8.8.

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-102015
CWE-122
Action timing
Immediate
ELI5

Explain it like I’m five

Plugging into a switch port and sending one crafted authentication frame can be enough to own the switch, before ever authenticating.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Attacker plugs in

    An unauthenticated attacker gains adjacent access to an 802.1X-authenticated interface.

  2. 02Crafted EAPOL frame sent

    The frame is built to overflow the secure-dot1xd heap buffer.

  3. 03Root code or denial of service

    The overflow executes code as root or disrupts the device.

What happened

Juniper disclosed CVE-2026-102015 in its October 2026 security release: a heap-based buffer overflow (CWE-122) in the secure-dot1xd process. An unauthenticated adjacent attacker can send an EAPOL frame to an interface with 802.1X authentication to execute code as root or deny service.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for dot1xd crashes and EAPOL frames with unusual sizes on access ports.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

802.1X is the control meant to keep strangers off the network. A pre-auth overflow in it deserves the emergency ring.